theory VSpace_C

lemma unmapPage_ccorres:
  "ccorres dc xfdc (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)
                          and (\<lambda>_. asid \<le> mask asid_bits \<and> vmsz_aligned' vptr sz
                                           \<and> vptr < pptrBase))
      (UNIV \<inter> {s. gen_framesize_to_H (page_size_' s) = sz \<and> page_size_' s < 4}
            \<inter> {s. asid_' s = asid} \<inter> {s. vptr_' s = vptr} \<inter> {s. pptr_' s = Ptr pptr}) []
      (unmapPage sz asid vptr pptr) (Call unmapPage_'proc)" apply (rule ccorres_gen_asm) apply (cinit lift: page_size_' asid_' vptr_' pptr_') apply (simp add: ignoreFailure_liftM ptr_add_assertion_positive Collect_True
               del: Collect_const) apply ccorres_remove_UNIV_guard apply csymbr apply (ctac add: findPDForASID_ccorres) apply (rename_tac pdPtr pd') apply (rule_tac P="page_directory_at' pdPtr" in ccorres_cross_over_guard) apply (simp add: liftE_bindE Collect_False bind_bindE_assoc
                  del: Collect_const) apply (rule ccorres_splitE_novcg[where r'=dc and xf'=xfdc])
          \<comment> \<open>ARMSmallPage\<close> apply (rule ccorres_Cond_rhs) apply (simp add: gen_framesize_to_H_def) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (ctac add: lookupPTSlot_ccorres) apply (rename_tac pt_slot pt_slot') apply simp apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
                  rule ccorres_rhs_assoc2) apply (rule ccorres_splitE_novcg) apply simp apply (rule checkMappingPPtr_pte_ccorres) apply (rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps') apply (simp add: cpte_relation_def Let_def pte_lift_def
                                isSmallPagePTE_def pte_tag_defs
                                pte_pte_small_lift_def pte_pte_invalid_def
                         split: if_split_asm pte.split_asm) apply (rule ceqv_refl) apply (simp add: liftE_liftM Collect_const[symmetric]
                         del: Collect_const) apply (rule ccorres_handlers_weaken2) apply csymbr apply (rule ccorres_split_nothrow_novcg_dc) apply (rule storePTE_Basic_ccorres) apply (simp add: cpte_relation_def Let_def) apply csymbr apply (ctac add: cleanByVA_PoU_ccorres) apply wp apply (simp add: guard_is_UNIV_def) apply wp apply (simp add: ccHoarePost_def guard_is_UNIV_def) apply (simp add: throwError_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_void_C') apply vcg apply (wp) apply simp apply (vcg exspec=lookupPTSlot_modifies)
          \<comment> \<open>ARMLargePage\<close> apply (rule ccorres_Cond_rhs) apply (simp add: gen_framesize_to_H_def
                            largePagePTEOffsets_def pteBits_def) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (ctac add: lookupPTSlot_ccorres) apply (rename_tac ptSlot lookupPTSlot_ret) apply (simp add: Collect_False del: Collect_const) apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
                  rule ccorres_rhs_assoc2) apply (rule ccorres_splitE_novcg, simp, rule checkMappingPPtr_pte_ccorres) apply (rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps') subgoal by (simp add: cpte_relation_def Let_def pte_lift_def
                                    isLargePagePTE_def pte_tag_defs
                                    pte_pte_large_lift_def pte_pte_invalid_def
                             split: if_split_asm pte.split_asm) apply (rule ceqv_refl) apply (simp add: liftE_liftM
                             mapM_discarded whileAnno_def ARMLargePageBits_def ARMSmallPageBits_def
                             Collect_False word_sle_def
                        del: Collect_const) apply (ccorres_remove_UNIV_guard) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac P="is_aligned ptSlot 6" in ccorres_gen_asm) apply (rule_tac F="\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)"
                        in ccorres_mapM_x_while) apply clarsimp apply (rule ccorres_guard_imp2) apply csymbr apply (rule ccorres_move_array_assertion_pte_16) apply (rule ccorres_flip_Guard, rule ccorres_move_array_assertion_pte_16) apply (rule storePTE_Basic_ccorres) apply (simp add: cpte_relation_def Let_def) apply clarsimp apply (simp add: unat_of_nat upto_enum_word of_nat_gt_0
                                         upto_enum_step_def del: upt.simps) apply (simp add: upto_enum_step_def) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply wp apply (simp add: upto_enum_step_def word_bits_def) apply ceqv apply (rule ccorres_handlers_weaken2) apply (rule ccorres_move_c_guard_pte) apply csymbr apply (rule ccorres_move_c_guard_pte ccorres_move_array_assertion_pte_16)+ apply (rule ccorres_add_return2,
                    ctac(no_vcg) add: cleanCacheRange_PoU_ccorres) apply (rule ccorres_move_array_assertion_pte_16, rule ccorres_return_Skip') apply wp apply (rule_tac P="is_aligned ptSlot 6" in hoare_gen_asm) apply (rule hoare_strengthen_post) apply (rule hoare_vcg_conj_lift) apply (rule_tac P="\<lambda>s. page_table_at' (ptSlot && ~~ mask ptBits) s
                         \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s"
                      in mapM_x_wp') apply wp[1] apply (rule mapM_x_accumulate_checks) apply (simp add: storePTE_def) apply (rule obj_at_setObject3) apply simp apply (simp add: objBits_simps archObjSize_def pteBits_def) apply (simp add: typ_at_to_obj_at_arches[symmetric]) apply wp apply clarify apply (subgoal_tac "P" for P) apply (frule bspec, erule hd_in_set) apply (frule bspec, erule last_in_set) subgoal by (simp add: upto_enum_step_def upto_enum_word take_bit_Suc
                                   hd_map last_map typ_at_to_obj_at_arches field_simps
                                  objBits_simps archObjSize_def,
                              clarsimp dest!: is_aligned_cache_preconds) apply (simp add: upto_enum_step_def upto_enum_word) apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (simp add: hd_map last_map upto_enum_step_def objBits_simps archObjSize_def
                             upto_enum_word) apply wp apply (simp add: guard_is_UNIV_def) apply (simp add: throwError_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_void_C') apply vcg apply (wp lookupPTSlot_inv Arch_R.lookupPTSlot_aligned lookupPTSlot_page_table_at'
                  | simp)+ apply (vcg exspec=lookupPTSlot_modifies)
          \<comment> \<open>ARMSection\<close> apply (rule ccorres_Cond_rhs) apply (rule ccorres_rhs_assoc)+ apply (csymbr, csymbr) apply (simp add: gen_framesize_to_H_def liftE_liftM
                       del: Collect_const) apply (simp split: if_split, rule conjI[rotated], rule impI,
                  rule ccorres_empty, rule impI) apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
                  rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
                  rule ccorres_rhs_assoc2) apply (rule ccorres_splitE_novcg, simp, rule checkMappingPPtr_pde_ccorres) apply (rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps') subgoal by (simp add: pde_pde_section_lift_def cpde_relation_def pde_lift_def
                                     Let_def pde_tag_defs isSectionPDE_def
                              split: pde.split_asm if_split_asm) apply (rule ceqv_refl) apply (simp add: Collect_False del: Collect_const) apply (rule ccorres_handlers_weaken2) apply csymbr apply (rule ccorres_split_nothrow_novcg_dc) apply (rule storePDE_Basic_ccorres) apply (simp add: cpde_relation_def Let_def
                              pde_lift_pde_invalid) apply csymbr apply (ctac add: cleanByVA_PoU_ccorres) apply wp apply (clarsimp simp: guard_is_UNIV_def) apply simp apply wp apply (simp add: guard_is_UNIV_def)
          \<comment> \<open>ARMSuperSection\<close> apply (rule ccorres_Cond_rhs) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (case_tac "pd = pde_Ptr (lookup_pd_slot pdPtr vptr)") prefer 2 apply (simp, rule ccorres_empty) apply (simp add: gen_framesize_to_H_def liftE_liftM mapM_discarded whileAnno_def
                            superSectionPDEOffsets_def pdeBits_def
                       del: Collect_const) apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
               rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2,
               rule ccorres_rhs_assoc2) apply (rule ccorres_splitE_novcg, simp, rule checkMappingPPtr_pde_ccorres) apply (rule conseqPre, vcg) apply (clarsimp simp: typ_heap_simps') subgoal by (simp add: cpde_relation_def Let_def pde_lift_def
                                     isSuperSectionPDE_def pde_tag_defs
                                     pde_pde_section_lift_def
                              split: if_split_asm pde.split_asm) apply (rule ceqv_refl) apply (simp add: Collect_False ARMSuperSectionBits_def
                              ARMSectionBits_def word_sle_def
                      del: Collect_const) apply (ccorres_remove_UNIV_guard) apply (rule ccorres_rhs_assoc2,
                 rule ccorres_split_nothrow_novcg) apply (rule_tac P="is_aligned pdPtr pdBits" in ccorres_gen_asm) apply (rule_tac F="\<lambda>_. page_directory_at' pdPtr" in ccorres_mapM_x_while) apply clarsimp apply (rule ccorres_guard_imp2) apply csymbr apply (rule ccorres_move_array_assertion_pde_16) apply (rule ccorres_flip_Guard, rule ccorres_move_array_assertion_pde_16) apply (rule storePDE_Basic_ccorres) apply (simp add: cpde_relation_def Let_def
                                    pde_lift_pde_invalid) apply clarsimp apply (simp add: unat_of_nat of_nat_gt_0
                                      upto_enum_step_def upto_enum_word) apply (simp add: vmsz_aligned'_def vmsz_aligned_def) apply (clarsimp simp: lookup_pd_slot_def Let_def
                                        mask_add_aligned field_simps) apply (erule less_pptrBase_valid_pde_offset') apply (simp add: vmsz_aligned'_def) apply (simp add: word_le_nat_alt unat_of_nat) apply (simp add: upto_enum_step_def) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply wp apply (simp add: upto_enum_step_def word_bits_def) apply ceqv apply (rule ccorres_handlers_weaken2) apply (rule ccorres_move_c_guard_pde) apply csymbr apply (rule ccorres_move_c_guard_pde ccorres_move_array_assertion_pde_16)+ apply (rule ccorres_add_return2) apply (ctac(no_vcg) add: cleanCacheRange_PoU_ccorres) apply (rule ccorres_move_array_assertion_pde_16, rule ccorres_return_Skip') apply wp apply (rule_tac P="is_aligned pdPtr pdBits" in hoare_gen_asm) apply (rule hoare_strengthen_post) apply (rule hoare_vcg_conj_lift) apply (rule_tac P="\<lambda>s. page_directory_at' pdPtr s
                      \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s"
                   in mapM_x_wp') apply wp[1] apply (rule mapM_x_accumulate_checks) apply (simp add: storePDE_def) apply (rule obj_at_setObject3) apply simp apply (simp add: objBits_simps archObjSize_def pdeBits_def) apply (simp add: typ_at_to_obj_at_arches[symmetric]) apply wp apply (clarsimp simp: vmsz_aligned_def vmsz_aligned'_def) apply (subgoal_tac "P" for P) apply (frule bspec, erule hd_in_set) apply (frule bspec, erule last_in_set) apply (simp add: upto_enum_step_def upto_enum_word take_bit_Suc
                                hd_map last_map typ_at_to_obj_at_arches field_simps
                                objBits_simps archObjSize_def vmsz_aligned'_def
                                pageBitsForSize_def pdBits_def pageBits_def pdeBits_def) apply (frule_tac x=14 and y=6 in is_aligned_weaken, clarsimp+) apply (drule is_aligned_lookup_pd_slot, simp) apply (clarsimp dest!: is_aligned_cache_preconds) apply (simp add: upto_enum_step_def upto_enum_word) apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem objBits_simps archObjSize_def) apply (simp add: upto_enum_step_def upto_enum_word
                              hd_map last_map) apply (simp, wp) apply (simp add: guard_is_UNIV_def) apply (rule ccorres_empty[where P=\<top>]) apply ceqv apply (simp add: liftE_liftM) apply (ctac add: flushPage_ccorres) apply ((wp lookupPTSlot_inv mapM_storePTE_invs[unfolded swp_def]
                 mapM_storePDE_invs[unfolded swp_def]
              | wpc | simp)+)[1] apply (simp add: guard_is_UNIV_def) apply (simp add: throwError_def) apply (rule ccorres_split_throws) apply (rule ccorres_return_void_C) apply vcg apply (simp add: lookup_pd_slot_def Let_def) apply (wp hoare_vcg_const_imp_lift_R) apply (simp add: Collect_const_mem) apply (vcg exspec=findPDForASID_modifies) apply (clarsimp simp: invs_arch_state' invs_no_0_obj' invs_valid_objs'
                        is_aligned_weaken[OF _ pbfs_atleast_pageBits]
                        vmsz_aligned'_def) by (auto simp: invs_arch_state' invs_no_0_obj' invs_valid_objs' vmsz_aligned'_def
                        is_aligned_weaken[OF _ pbfs_atleast_pageBits]
                        pageBitsForSize_def gen_framesize_to_H_def
                        Collect_const_mem vm_page_size_defs word_sle_def
                        ccHoarePost_def typ_heap_simps pageBits_def
            dest!: page_directory_at_rf_sr
            elim!: clift_array_assertion_imp
            split: vmpage_size.splits
    | unat_arith)+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) and (\<lambda>_. asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase)) (UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = sz \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) pptr\<rbrace>) [] (unmapPage sz asid vptr pptr) (Call unmapPage_'proc) proof (prove)
goal (1 subgoal):
 1. asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase \<Longrightarrow> ccorres dc xfdc (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = sz \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) pptr\<rbrace>) [] (unmapPage sz asid vptr pptr) (Call unmapPage_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pptra vptra asida page_size. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9130 pptra vptra asida page_size) (?Q'9130 pptra vptra asida page_size) [SKIP] (ignoreFailure (doE pd <- findPDForASID asid;
y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE)) (\<acute>addr :== CALL addrFromPPtr_'proc(pptra);;
(\<acute>find_ret :== CALL findPDForASID_'proc(asida);;
(IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptra);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptra);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>ptr_add_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p sint 0));;
Guard MemorySafety \<lbrace>ptr_add_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) 0 False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
Guard MemorySafety \<lbrace>ptr_add_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>ptr_add_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p sint 0),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint ((1 << unat (ARMLargePageBits - ARMSmallPageBits)) - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>ptr_add_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) 0 False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptra);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptra);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>pd 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>pd 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (\<acute>pd +\<^sub>p sint 0));;
Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>pd 0 False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>pd 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>pd 0 False (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (\<acute>pd +\<^sub>p sint 0),ptr_val (\<acute>pd +\<^sub>p uint ((1 << unat (ARMSuperSectionBits - ARMSectionBits)) - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>ptr_add_assertion \<acute>pd 0 False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C \<acute>find_ret,asida,vptra)))))
 2. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q9130 pptra vptra asida page_size s \<and> s' \<in> ?Q'9130 pptra vptra asida page_size proof (prove)
goal (2 subgoals):
 1. \<And>pptra vptra asida page_size. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9130 (PTR(unit) pptr) vptr asid page_size) (?Q'9130 (PTR(unit) pptr) vptr asid page_size) [SKIP] (doE pd <- findPDForASID asid;
y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE) (\<acute>addr :== CALL addrFromPPtr_'proc(PTR(unit) pptr);;
(\<acute>find_ret :== CALL findPDForASID_'proc(asid);;
(IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard MemorySafety UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety UNIV (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
Guard MemorySafety UNIV SKIP)));;
Guard MemorySafety UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety UNIV (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety UNIV SKIP))))))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard MemorySafety UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety UNIV (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
Guard MemorySafety UNIV SKIP)));;
Guard MemorySafety UNIV (Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety UNIV (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety UNIV SKIP))))))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C \<acute>find_ret,asid,vptr)))))
 2. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q9130 pptra vptra asida page_size s \<and> s' \<in> ?Q'9130 pptra vptra asida page_size proof (prove)
goal (2 subgoals):
 1. \<And>pptra vptra asida page_size rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9130 (PTR(unit) pptr) vptr asid page_size) (?G'9157 page_size rv') [SKIP] (doE pd <- findPDForASID asid;
y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE) (\<acute>addr :== CALL addrFromPPtr_'proc(PTR(unit) pptr);;
(\<acute>find_ret :== CALL findPDForASID_'proc(asid);;
(IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> \<acute>addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C \<acute>find_ret,asid,vptr)))))
 2. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q9130 pptra vptra asida page_size s \<and> s' \<in> {s. s \<in> ?G'9156 pptra vptra asida page_size}
flex-flex pairs:
\<lambda>page_size. ?G'9157 page_size () \<equiv>\<^sup>? ?G'9156 (PTR(unit) pptr) vptr asid proof (prove)
goal (2 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q9130 (PTR(unit) pptr) vptr asid page_size) (?G'10016 page_size rv' addr) [SKIP] (doE pd <- findPDForASID asid;
y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pd vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pd asid vptr)
odE) (\<acute>find_ret :== CALL findPDForASID_'proc(asid);;
(IF findPDForASID_ret_C.status_C \<acute>find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C \<acute>find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C \<acute>find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C \<acute>find_ret,asid,vptr))))
 2. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q9130 pptra vptra asida page_size s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> ?G'10017 pptra vptra asida page_size v}}
flex-flex pairs:
?G'10017 (PTR(unit) pptr) vptr asid \<equiv>\<^sup>? \<lambda>page_size. ?G'10016 page_size () proof (prove)
goal (5 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr rv find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C find_ret = pde_Ptr rv; findPDForASID_ret_C.status_C find_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12075 pptra vptra asida page_size rv' addr rv) (?Q'12075 pptra vptra asida page_size rv' addr rv find_ret) [SKIP] (doE y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot rv vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot rv vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot rv vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot rv vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz rv asid vptr)
odE) (IF findPDForASID_ret_C.status_C find_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C find_ret,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C find_ret,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C find_ret,asid,vptr)))
 2. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>?Q12075 pptra vptra asida page_size rv' addr\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> ?Q'12075 pptra vptra asida page_size rv' addr rv (find_ret_' s))) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (5 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q12075 pptra vptra asida page_size rv' addr pdPtr) (?Q'12075 pptra vptra asida page_size rv' addr pdPtr pd') [SKIP] (doE y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pdPtr asid vptr)
odE) (IF findPDForASID_ret_C.status_C pd' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C pd',vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C pd',vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C pd',vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C pd',vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C pd',asid,vptr)))
 2. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>?Q12075 pptra vptra asida page_size rv' addr\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> ?Q'12075 pptra vptra asida page_size rv' addr rv (find_ret_' s))) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (5 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'14127 pptra vptra asida page_size rv' addr pdPtr) (?Q14124 pptra vptra asida page_size rv' addr pdPtr pd') [SKIP] (doE y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pdPtr asid vptr)
odE) (IF findPDForASID_ret_C.status_C pd' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C pd',vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C pd',vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C pd',vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C pd',vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C pd',asid,vptr)))
 2. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ?P'14127 pptra vptra asida page_size rv' addr a\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> ?Q14124 pptra vptra asida page_size rv' addr rv (find_ret_' s)})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (5 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'14127 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?Q14124 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE y <- case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE;
liftE (flushPage sz pdPtr asid vptr)
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr))
 2. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ?P'14127 pptra vptra asida page_size rv' addr a\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> ?Q14124 pptra vptra asida page_size rv' addr rv (find_ret_' s)})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (9 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?P14159 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?P'14153 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 6. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 7. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and (?P14159 pptra vptra asida page_size rv' addr a and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> ?P'14153 pptra vptra asida page_size rv' addr rv (find_ret_' s) \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14170 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?S14173 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?Q14170 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?S14173 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14170 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr) (?S14173 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl p);
liftE (do y <- storePTE p ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?Q14170 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?S14173 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14170 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr) (?S14173 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl p);
liftE (do y <- storePTE p ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
(\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
(IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?Q14170 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?S14173 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14170 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr) (?G'14223 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl p);
liftE (do y <- storePTE p ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU p (addrFromPPtr p))
od)
odE) (\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
(IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?Q14170 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> ?G'14223 pptra vptra asida page_size rv' addr rv (find_ret_' s)}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' rv lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C lu_ret___struct_lookupPTSlot_ret_C = pte_Ptr rv; lookupPTSlot_ret_C.status_C lu_ret___struct_lookupPTSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14239 pptra vptra asida page_size addr pdPtr pd' rv) (?Q'14239 pptra vptra asida page_size addr pdPtr pd' rv lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl rv);
liftE (do y <- storePTE rv ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU rv (addrFromPPtr rv))
od)
odE) (IF lookupPTSlot_ret_C.status_C lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C lu_ret___struct_lookupPTSlot_ret_C} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'14239 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14239 pptra vptra asida page_size addr pdPtr pd' pt_slot) (?Q'14239 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot);
liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)
odE) (IF lookupPTSlot_ret_C.status_C pt_slot' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C pt_slot');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C pt_slot');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C pt_slot'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C pt_slot') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C pt_slot'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C pt_slot'),\<acute>ret__unsigned_long)))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'14239 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot) (?Q'14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot') [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot);
liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)
odE) (\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr pt_slot);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(pte_Ptr pt_slot);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'14239 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot) (?Q'14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot') [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot);
liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)
odE) (\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'14239 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot')) (?xf'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') (inl_rrel (inl_rrel dc)) xfdc (?P14616 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot) (?P'14610 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot') [SKIP] (checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot)) (\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') rv' t t' (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (?r'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot')) (?xf'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. ?P14616 pptra vptra asida page_size addr pdPtr pd' a and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?P'14610 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s) \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot')) (?xf'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') (inl_rrel dc) xfdc (?P14616 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot) (?P'14610 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot') [SKIP] (checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot)) (\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') rv' t t' (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (?r'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot')) (?xf'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot') (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. ?P14616 pptra vptra asida page_size addr pdPtr pd' a and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?P'14610 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s) \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' pte \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> (\<exists>pte'. cslift s (pte_Ptr pt_slot) = Some pte' \<and> cpte_relation pte pte') \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(pte_Ptr pt_slot);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI {s. (\<sigma>, s) \<in> rf_sr \<and> (isSmallPagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr},{s. (\<sigma>, s) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' pte \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. True \<and> (\<exists>pte'. cslift s (pte_Ptr pt_slot) = Some pte' \<and> cpte_relation pte pte') \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot \<and> (\<forall>t. ret__unsigned_' t = pte_get_tag (the (cslift s (pte_Ptr pt_slot))) \<longrightarrow> (pte_get_tag (the (cslift s (pte_Ptr pt_slot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr pt_slot \<and> pte_get_tag (the (cslift s (pte_Ptr pt_slot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (\<forall>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) \<longrightarrow> (pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr))) \<and> (pte_get_tag (the (cslift s (pte_Ptr pt_slot))) \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr pt_slot \<and> pte_get_tag (the (cslift s (pte_Ptr pt_slot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr pt_slot)))) \<longrightarrow> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr pt_slot)))) = SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_large = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr pt_slot \<and> pte_get_tag (the (cslift s (pte_Ptr pt_slot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (\<forall>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) \<longrightarrow> (pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)))) \<and> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr pt_slot)))) \<noteq> SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_invalid, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr pt_slot \<and> pte_get_tag (the (cslift s (pte_Ptr pt_slot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (\<forall>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) \<longrightarrow> (pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr pt_slot)))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSmallPagePTE pte \<or> isLargePagePTE pte \<and> Wellformed_C.ARMSmallPage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)))))))}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pdPtr pd' pt_slot pt_slot' pte \<sigma> x pte' t. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; sz = Wellformed_C.ARMSmallPage; (\<sigma>, x) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMSmallPage; vptr < pptrBase; cslift x (pte_Ptr pt_slot) = Some pte'; cpte_relation pte pte'; ret__unsigned_' t = pte_get_tag pte'\<rbrakk> \<Longrightarrow> (pte_get_tag pte' = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (\<exists>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift pte')) \<longrightarrow> (pte_pte_small_CL.address_CL (pte_pte_small_lift pte') \<noteq> addrFromPPtr pptr \<longrightarrow> isSmallPagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> (pte_pte_small_CL.address_CL (pte_pte_small_lift pte') = addrFromPPtr pptr \<longrightarrow> isSmallPagePTE pte \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_get_tag pte' \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> pte_get_tag pte' = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift pte')) \<longrightarrow> (reserved_CL (pte_pte_large_lift pte') = 1 \<longrightarrow> (pte_pte_large \<noteq> pte_pte_small \<longrightarrow> isSmallPagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> pte_pte_large \<noteq> pte_pte_small) \<and> (reserved_CL (pte_pte_large_lift pte') \<noteq> 1 \<longrightarrow> (pte_pte_invalid \<noteq> pte_pte_small \<longrightarrow> isSmallPagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> pte_pte_invalid \<noteq> pte_pte_small)))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (?d'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv) (?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv rv') [SKIP] (liftE (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od)) (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q14609 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()) (?Q'14609 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' () rv') [SKIP] (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od) (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14609 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()) (?Q'14609 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' () rv') [] (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od) (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14609 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()) (?G'14840 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' () rv' ret__struct_pte_C) [] (do y <- storePTE pt_slot ARM_H.InvalidPTE;
doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long)))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>?Q14609 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> ?G'14840 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v) a va})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P14968 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()) (?G'14840 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' () rv' ret__struct_pte_C) [] (storePTE pt_slot ARM_H.InvalidPTE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr pt_slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr pt_slot) ret__struct_pte_C))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>); dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y) (?Q'14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a) [] (doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R14966 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()\<rbrace> storePTE pt_slot ARM_H.InvalidPTE \<lbrace>?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. ?P14968 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' a and ?R14966 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> ?G'14840 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' (theRight v) a va})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> cpte_relation ARM_H.InvalidPTE ret__struct_pte_C
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>); dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y) (?Q'14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a) [] (doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R14966 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()\<rbrace> storePTE pt_slot ARM_H.InvalidPTE \<lbrace>?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14966 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>); dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y) (?Q'14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a) [] (doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) pt_slot);;
CALL cleanByVA_PoU_'proc(pt_slot,\<acute>ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R14966 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()\<rbrace> storePTE pt_slot ARM_H.InvalidPTE \<lbrace>?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14966 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>); dc y rv'a; ret__unsigned_long = addrFromPPtr pt_slot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y) (?G'14981 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a ret__unsigned_long) [] (doMachineOp (cleanByVA_PoU pt_slot (addrFromPPtr pt_slot))) (CALL cleanByVA_PoU_'proc(pt_slot,ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R14966 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()\<rbrace> storePTE pt_slot ARM_H.InvalidPTE \<lbrace>?Q14962 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) pt_slot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'14981 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C y rv'a v})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14966 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R14966 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot pt_slot' ()\<rbrace> storePTE pt_slot ARM_H.InvalidPTE \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) pt_slot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. paddr_'_update (\<lambda>_. v) (vaddr_'_update (\<lambda>_. pt_slot) s) \<in> \<lbrace>\<acute>vaddr = pt_slot\<rbrace> \<inter> \<lbrace>\<acute>paddr = addrFromPPtr pt_slot\<rbrace>}})
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14966 pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' a\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot' rv' ret__struct_pte_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) pt_slot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. paddr_'_update (\<lambda>_. v) (vaddr_'_update (\<lambda>_. pt_slot) s) \<in> \<lbrace>\<acute>vaddr = pt_slot\<rbrace> \<inter> \<lbrace>\<acute>paddr = addrFromPPtr pt_slot\<rbrace>}})
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14614 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' pt_slot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSmallPage (Inl pt_slot) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>, -
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 3. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R14614 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pt_slot pt_slot'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; ptSlot_C pt_slot' = pte_Ptr pt_slot; lookupPTSlot_ret_C.status_C pt_slot' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pte_lift va = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0, \<dots> = theRight v\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := va\<rparr> \<in> \<lbrace>pt_slot = pt_slot\<rbrace>})
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 pptra vptra asida page_size addr pdPtr pd' err) (?Q''14239 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and ?R14247 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' err) (?Q''14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (return (Inl err)) (return_void_C;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv') \<acute>ret__struct_pte_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv'));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C rv'),\<acute>ret__unsigned_long)))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''14239 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and ?R14247 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE14239 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' err) (?P'15057 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (return (Inl err)) return_void_C
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) return_void_C {},UNIV
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>?QE14239 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?P'15057 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s) \<inter> ?R'15056 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) return_void_C {},UNIV
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'15056 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and ?R14247 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>?R14247 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and ?R14247 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> ?R'14240 pptra vptra asida page_size rv' addr rv (find_ret_' s)}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> ?R'14240 pptra vptra asida page_size rv' addr rv (find_ret_' s)}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSmallPage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSmallPage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14240 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) UNIV
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> ?R'14240 pptra vptra asida page_size rv' addr rv (find_ret_' s)}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (9 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R14169 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T14171 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 6. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 7. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> ?R14169 pptra vptra asida page_size rv' addr a b)) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> ?T14171 pptra vptra asida page_size rv' addr rv (find_ret_' s))} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15133 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?S15136 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?Q15133 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?S15136 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15133 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr) (?S15136 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?Q15133 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?S15136 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15133 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr) (?S15136 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
(lvar_nondet_init i_' i_'_update;;
(\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
(IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?Q15133 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?S15136 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15133 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr) (?G'15190 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (lvar_nondet_init i_' i_'_update;;
(\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
(IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?Q15133 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> ?G'15190 pptra vptra asida page_size rv' addr rv (find_ret_' s)}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15133 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr) (?G'15209 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') [SKIP] (doE p <- lookupPTSlot pdPtr vptr;
y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl p);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))))
od)
odE) (\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr);;
(IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?Q15133 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> ?G'15209 pptra vptra asida page_size rv' addr rv (find_ret_' s)}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' rv lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lu_ret___struct_lookupPTSlot_ret_C = pte_Ptr rv; lookupPTSlot_ret_C.status_C lu_ret___struct_lookupPTSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15225 pptra vptra asida page_size addr pdPtr pd' rv) (?Q'15225 pptra vptra asida page_size addr pdPtr pd' rv lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl rv);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + rv) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + rv) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + rv) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + rv) [0 , 4 .e. 0x3C]))))
od)
odE) (IF lookupPTSlot_ret_C.status_C lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C lu_ret___struct_lookupPTSlot_ret_C);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C lu_ret___struct_lookupPTSlot_ret_C} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C lu_ret___struct_lookupPTSlot_ret_C} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'15225 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15225 pptra vptra asida page_size addr pdPtr pd' ptSlot) (?Q'15225 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)
odE) (IF lookupPTSlot_ret_C.status_C lookupPTSlot_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C lookupPTSlot_ret);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C lookupPTSlot_ret);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C lookupPTSlot_ret) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C lookupPTSlot_ret +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C lookupPTSlot_ret) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C lookupPTSlot_ret +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C lookupPTSlot_ret} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C lookupPTSlot_ret)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C lookupPTSlot_ret} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C lookupPTSlot_ret) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C lookupPTSlot_ret +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C lookupPTSlot_ret) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C lookupPTSlot_ret),ptr_val (ptSlot_C lookupPTSlot_ret +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C lookupPTSlot_ret) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'15225 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot) (?Q'15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)
odE) (\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr ptSlot);;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(pte_Ptr ptSlot);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'15225 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot) (?Q'15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot);
liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)
odE) (\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr ptSlot);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(pte_Ptr ptSlot);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>?Q15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> ?Q'15225 pptra vptra asida page_size addr pdPtr pd' rv (lu_ret___struct_lookupPTSlot_ret_C_' s))) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret pte \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> (\<exists>pte'. cslift s (pte_Ptr ptSlot) = Some pte' \<and> cpte_relation pte pte') \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(pte_Ptr ptSlot);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(pte_Ptr ptSlot);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI {s. (\<sigma>, s) \<in> rf_sr \<and> (isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr},{s. (\<sigma>, s) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMLargePage) \<and> pteFrame pte = addrFromPPtr pptr)}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv) (?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv') [SKIP] (liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret pte \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. True \<and> (\<exists>pte'. cslift s (pte_Ptr ptSlot) = Some pte' \<and> cpte_relation pte pte') \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot \<and> (\<forall>t. ret__unsigned_' t = pte_get_tag (the (cslift s (pte_Ptr ptSlot))) \<longrightarrow> (pte_get_tag (the (cslift s (pte_Ptr ptSlot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_small \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_small = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr ptSlot \<and> pte_get_tag (the (cslift s (pte_Ptr ptSlot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)))) \<and> (pte_get_tag (the (cslift s (pte_Ptr ptSlot))) \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr ptSlot \<and> pte_get_tag (the (cslift s (pte_Ptr ptSlot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<longrightarrow> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) = SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr ptSlot \<and> pte_get_tag (the (cslift s (pte_Ptr ptSlot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr))) \<and> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<noteq> SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_invalid, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr ptSlot \<and> pte_get_tag (the (cslift s (pte_Ptr ptSlot))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr ptSlot)))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSmallPagePTE pte \<and> Wellformed_C.ARMLargePage = Wellformed_C.ARMSmallPage \<or> isLargePagePTE pte) \<and> pteFrame pte = addrFromPPtr pptr)))))))}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv) (?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv') [SKIP] (liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret pte \<sigma> x pte' t. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; (\<sigma>, x) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; cslift x (pte_Ptr ptSlot) = Some pte'; cpte_relation pte pte'; ret__unsigned_' t = pte_get_tag pte'\<rbrakk> \<Longrightarrow> (pte_get_tag pte' = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (pte_pte_small \<noteq> pte_pte_large \<longrightarrow> isLargePagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> (pte_pte_small = pte_pte_large \<longrightarrow> (\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift pte')) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte') \<noteq> addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte') = addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte \<and> pteFrame pte = addrFromPPtr pptr))) \<and> (pte_get_tag pte' \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> pte_get_tag pte' = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift pte')) \<longrightarrow> (reserved_CL (pte_pte_large_lift pte') = 1 \<longrightarrow> pte_get_tag pte' = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift pte')) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte') \<noteq> addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte') = addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte \<and> pteFrame pte = addrFromPPtr pptr))) \<and> (reserved_CL (pte_pte_large_lift pte') \<noteq> 1 \<longrightarrow> (pte_pte_invalid \<noteq> pte_pte_large \<longrightarrow> isLargePagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> (pte_pte_invalid = pte_pte_large \<longrightarrow> pte_get_tag pte' = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift pte')) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte') \<noteq> addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte \<longrightarrow> pteFrame pte \<noteq> addrFromPPtr pptr) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte') = addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte \<and> pteFrame pte = addrFromPPtr pptr))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv) (?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv') [SKIP] (liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pd_C pd'_ = pde_Ptr pdPtr_; findPDForASID_ret_C.status_C pd'_ = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret_ = pte_Ptr ptSlot_; lookupPTSlot_ret_C.status_C lookupPTSlot_ret_ = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; (\<sigma>_, x_) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; cslift x_ (pte_Ptr ptSlot_) = Some pte'_; cpte_relation pte_ pte'_; ret__unsigned_' t_ = pte_get_tag pte'_\<rbrakk> \<Longrightarrow> (pte_get_tag pte'_ = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (pte_pte_small \<noteq> pte_pte_large \<longrightarrow> isLargePagePTE pte_ \<longrightarrow> pteFrame pte_ \<noteq> addrFromPPtr pptr) \<and> (pte_pte_small = pte_pte_large \<longrightarrow> (\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_)) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_) \<noteq> addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte_ \<longrightarrow> pteFrame pte_ \<noteq> addrFromPPtr pptr) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_) = addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte_ \<and> pteFrame pte_ = addrFromPPtr pptr))) \<and> (pte_get_tag pte'_ \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> pte_get_tag pte'_ = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift pte'_)) \<longrightarrow> (reserved_CL (pte_pte_large_lift pte'_) = 1 \<longrightarrow> pte_get_tag pte'_ = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_)) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_) \<noteq> addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte_ \<longrightarrow> pteFrame pte_ \<noteq> addrFromPPtr pptr) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_) = addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte_ \<and> pteFrame pte_ = addrFromPPtr pptr))) \<and> (reserved_CL (pte_pte_large_lift pte'_) \<noteq> 1 \<longrightarrow> (pte_pte_invalid \<noteq> pte_pte_large \<longrightarrow> isLargePagePTE pte_ \<longrightarrow> pteFrame pte_ \<noteq> addrFromPPtr pptr) \<and> (pte_pte_invalid = pte_pte_large \<longrightarrow> pte_get_tag pte'_ = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_)) \<longrightarrow> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_) \<noteq> addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte_ \<longrightarrow> pteFrame pte_ \<noteq> addrFromPPtr pptr) \<and> (pte_pte_large_CL.address_CL (pte_pte_large_lift pte'_) = addrFromPPtr pptr \<longrightarrow> isLargePagePTE pte_ \<and> pteFrame pte_ = addrFromPPtr pptr)))))) proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv) (?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv') [SKIP] (liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)) (?d'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v))
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv) (?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv rv') [SKIP] (liftE (do y <- mapM (swp storePTE ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od)) (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,ptSlot + 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (pte_Ptr ptSlot) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q15800 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()) (?Q'15800 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret () rv') [SKIP] (do _ <- mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od) (\<acute>i :== 0;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV (While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q15800 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()) (?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) [SKIP] (do _ <- mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'15926 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v) a})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' ptSlot lookupPTSlot_ret rv'. ?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd' ptSlot lookupPTSlot_ret. ?G'15926 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q15800 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()) (?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) [SKIP] (do _ <- mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>?Q15800 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'15926 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v) a})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' ptSlot lookupPTSlot_ret rv'. ?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd' ptSlot lookupPTSlot_ret. ?G'15926 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (19 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?r'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?xf'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?P16058 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()) (?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) [] (mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?xf'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. ?P16058 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'15926 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v) a})
 8. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' ptSlot lookupPTSlot_ret rv'. ?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd' ptSlot lookupPTSlot_ret. ?G'15926 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (19 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> ccorres (?r'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?xf'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?G16068 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()) (?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) [] (mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?xf'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. ?G16068 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'15926 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret (theRight v) a})
 8. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' ptSlot lookupPTSlot_ret rv'. ?G'15927 pdPtr pd' ptSlot lookupPTSlot_ret rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd' ptSlot lookupPTSlot_ret. ?G'15926 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (23 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>n<length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). ccorres dc xfdc (page_table_at' (ptSlot && ~~ mask ptBits)) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE) (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
A total of 23 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (23 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (page_table_at' (ptSlot && ~~ mask ptBits)) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (storePTE ([0 , 4 .e. 0x3C] ! n + ptSlot) ARM_H.InvalidPTE) (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
A total of 23 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (24 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16086 pdPtr pd' ptSlot lookupPTSlot_ret n) (?Q'16086 pdPtr pd' ptSlot lookupPTSlot_ret n) [] (storePTE ([0 , 4 .e. 0x3C] ! n + ptSlot) ARM_H.InvalidPTE) (\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))))
 2. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q16086 pdPtr pd' ptSlot lookupPTSlot_ret n s \<and> s' \<in> ?Q'16086 pdPtr pd' ptSlot lookupPTSlot_ret n
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
A total of 24 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (24 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16086 pdPtr pd' ptSlot lookupPTSlot_ret n) (?G'16092 pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C) [] (storePTE ([0 , 4 .e. 0x3C] ! n + ptSlot) ARM_H.InvalidPTE) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) ret__struct_pte_C))))))
 2. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q16086 pdPtr pd' ptSlot lookupPTSlot_ret n s \<and> s' \<in> {s. \<forall>v. pte_lift v = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := v\<rparr> \<in> ?G'16092 pdPtr pd' ptSlot lookupPTSlot_ret n v}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
A total of 24 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (24 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A16165 pdPtr pd' ptSlot lookupPTSlot_ret n) (?C'16162 pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C) [] (storePTE ([0 , 4 .e. 0x3C] ! n + ptSlot) ARM_H.InvalidPTE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) ret__struct_pte_C)))))
 2. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?A16165 pdPtr pd' ptSlot lookupPTSlot_ret n and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6)) s \<and> s' \<in> {s. \<forall>v. pte_lift v = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := v\<rparr> \<in> ?C'16162 pdPtr pd' ptSlot lookupPTSlot_ret n v \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
A total of 24 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (24 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A16173 pdPtr pd' ptSlot lookupPTSlot_ret n) (?C'16170 pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C) [] (storePTE ([0 , 4 .e. 0x3C] ! n + ptSlot) ARM_H.InvalidPTE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) ret__struct_pte_C))))
 2. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?A16173 pdPtr pd' ptSlot lookupPTSlot_ret n and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6)) s \<and> s' \<in> {s. \<forall>v. pte_lift v = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := v\<rparr> \<in> ?C'16170 pdPtr pd' ptSlot lookupPTSlot_ret n v \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
A total of 24 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (24 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n ret__struct_pte_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pte_lift ret__struct_pte_C = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> cpte_relation ARM_H.InvalidPTE ret__struct_pte_C
 2. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6)) s \<and> s' \<in> {s. \<forall>v. pte_lift v = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := v\<rparr> \<in> \<lbrace>ptSlot + \<acute>i * 4 = [0 , 4 .e. 0x3C] ! n + ptSlot\<rbrace> \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
A total of 24 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (23 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6)) s \<and> s' \<in> {s. \<forall>v. pte_lift v = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>) \<longrightarrow> s\<lparr>ret__struct_pte_C_' := v\<rparr> \<in> \<lbrace>ptSlot + \<acute>i * 4 = [0 , 4 .e. 0x3C] ! n + ptSlot\<rbrace> \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
A total of 23 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (23 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret n s s' v. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_table_at' (ptSlot && ~~ mask ptBits) s; i_' s' = word_of_nat n; pte_lift v = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>)\<rbrakk> \<Longrightarrow> word_of_nat n * 4 = [0 , 4 .e. 0x3C] ! n \<and> unat (word_of_nat n) \<le> 15 \<and> unat (word_of_nat n) \<le> 16 \<and> (word_of_nat n \<noteq> 0 \<longrightarrow> 0 < unat (word_of_nat n))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
A total of 23 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (22 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
A total of 22 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_Ptr (ptSlot + \<acute>i * 4)) \<acute>ret__struct_pte_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 10. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. \<forall>t. pte_lift (ret__struct_pte_C_' t) = Some (Pte_pte_large \<lparr>pte_pte_large_CL.address_CL = 0, XN_CL = 0, TEX_CL = 0, nG_CL = 0, S_CL = 0, APX_CL = 0, AP_CL = 0, C_CL = 0, B_CL = 0, reserved_CL = 0\<rparr>) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pte_Ptr ptSlot) (unat (i_' sa)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c pte_Ptr (ptSlot + i_' sa * 4) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pte_Ptr ptSlot) (Suc (unat (i_' sa))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = i_' s}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 10. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; Suc n < length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace> storePTE (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPTE \<lbrace>\<lambda>_. page_table_at' (ptSlot && ~~ mask ptBits)\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 9. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (19 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 8. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (?d'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (?Q'16052 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A16361 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?C'16358 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) ptSlot);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A16361 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a a and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. ?C'16358 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr ptSlot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A16361 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?G'16368 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr ptSlot} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pte_Ptr (ptSlot + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A16361 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a a and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'16368 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b v} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr ptSlot\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A16503 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv) (?C'16500 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))))) (CALL cleanCacheRange_PoU_'proc(ptSlot,0x3F + ptSlot,ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A16503 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a a and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?C'16500 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b v \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long rva xfdca. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr ptSlot; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q16511 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long rva) (?Q'16511 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long rva xfdca) [] (return rva) (Guard MemorySafety \<lbrace>array_assertion (pte_Ptr ptSlot) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr ptSlot\<rbrakk> \<Longrightarrow> \<lbrace>?R16515 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv\<rbrace> doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))) \<lbrace>?Q16511 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and ?R16515 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a a and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'16511 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b v rva (xfdc t)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv'b = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr ptSlot\<rbrakk> \<Longrightarrow> \<lbrace>?R16515 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv\<rbrace> doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6)\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and ?R16515 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a a and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R16056 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ?R16056 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<lbrace>?P'16581 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and (?P'16581 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a and K (is_aligned ptSlot 6))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<lbrace>?P'16581 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16583 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; ?Q16583 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and (?P'16581 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<lbrace>?P16589 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<lbrace>?P'16588 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q'16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; ?Q16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s \<and> ?Q'16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>b. ?P16589 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a b \<and> ?P'16588 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a b) and K (is_aligned ptSlot 6))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv s. page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<lbrace>?P'16588 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q'16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> ?Q'16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>b. (page_table_at' (ptSlot && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> ?P'16588 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a b) and K (is_aligned ptSlot 6))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6\<rbrakk> \<Longrightarrow> \<lbrace>?P'16588 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret ()\<rbrace> mapM_x (\<lambda>a. storePTE a ARM_H.InvalidPTE) (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<lbrace>?Q'16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> ?Q'16587 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>b. (page_table_at' (ptSlot && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> ?P'16588 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret a b) and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. ?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a y\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. ?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a y\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). ?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' x. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> (\<lambda>x. x + ptSlot) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> setObject x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. ?P16601 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot lookupPTSlot_ret rv' () x\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a y\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. ?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a y\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). ?P16601 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (19 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' x ko uu_ xa y n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> (\<lambda>x. x + ptSlot) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> updateObject ARM_H.InvalidPTE ko x y n uu_ = updateObject_default ARM_H.InvalidPTE ko x y n uu_
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' x v. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> (\<lambda>x. x + ptSlot) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 8. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
A total of 19 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' x v. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> (\<lambda>x. x + ptSlot) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; x \<in> (\<lambda>x. x + ptSlot) ` set [0 , 4 .e. 0x3C]; y \<in> (\<lambda>x. x + ptSlot) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>pte_at' y\<rbrace> storePTE x ARM_H.InvalidPTE \<lbrace>\<lambda>rv. pte_at' y\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; (page_table_at' (ptSlot && ~~ mask ptBits) s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s; ?P16631 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ?P16631 pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s; map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] \<noteq> []; obj_at' (\<lambda>a. True) (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s; map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] \<noteq> []; obj_at' (\<lambda>a. True) (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) s; obj_at' (\<lambda>a. True) (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot)) and pte_at' (ptr_val (pte_Ptr ptSlot))) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pd_C pd'_ = pde_Ptr pdPtr_; findPDForASID_ret_C.status_C pd'_ = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret_ = pte_Ptr ptSlot_; lookupPTSlot_ret_C.status_C lookupPTSlot_ret_ = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot_ 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s_; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot_ && ~~ mask ptBits) s_; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s_; map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C] \<noteq> []; obj_at' (\<lambda>a. True) (hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) s_; obj_at' (\<lambda>a. True) (last (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) s_\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot_) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_table_at' (ptr_val (pte_Ptr ptSlot_) && ~~ mask ptBits) a \<and> is_aligned (ptr_val (pte_Ptr ptSlot_)) 6) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot_) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot_)) 6) and pte_at' (ptr_val (pte_Ptr (ptSlot_ + 0x3C))) and (\<lambda>s. page_table_at' (ptr_val (pte_Ptr ptSlot_) && ~~ mask ptBits) s \<and> is_aligned (ptr_val (pte_Ptr ptSlot_)) 6) and pte_at' (ptr_val (pte_Ptr ptSlot_)) and pte_at' (ptr_val (pte_Ptr ptSlot_))) s_ proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a rv s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned ptSlot 6; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; \<forall>x\<in>set (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; page_table_at' (ptSlot && ~~ mask ptBits) s; 2 ^ pageBitsForSize Wellformed_C.ARMLargePage \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C] \<noteq> []
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) ptSlot) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + ptSlot) (start_'_update (\<lambda>_. ptSlot) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> (Suc 0 \<noteq> 0 \<longrightarrow> 15 \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pdPtr pd' ptSlot lookupPTSlot_ret s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; sz = Wellformed_C.ARMLargePage; vmsz_aligned' vptr Wellformed_C.ARMLargePage; vptr < pptrBase; i_' s = word_of_nat (length [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> ptSlot = hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<and> 0x3C + ptSlot = last (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]) \<and> addrFromPPtr ptSlot = addrFromPPtr (hd (map (\<lambda>x. x + ptSlot) [0 , 4 .e. 0x3C]))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R15805 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' ptSlot\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMLargePage (Inl ptSlot) \<lbrace>\<lambda>a. page_table_at' (ptSlot && ~~ mask ptBits) and (\<lambda>_. is_aligned ptSlot 6) and ((\<lambda>a. (page_table_at' (ptSlot && ~~ mask ptBits) a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned ptSlot 6))\<rbrace>, -
 2. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 3. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R15805 pptra vptra asida page_size addr pdPtr pd' a\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' ptSlot lookupPTSlot_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; ptSlot_C lookupPTSlot_ret = pte_Ptr ptSlot; lookupPTSlot_ret_C.status_C lookupPTSlot_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and (page_table_at' (a && ~~ mask ptBits) and (\<lambda>_. is_aligned a 6) and ((\<lambda>b. (page_table_at' (a && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> True) and K (is_aligned a 6)))\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 pptra vptra asida page_size addr pdPtr pd' err) (?Q''15225 pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (throwError err) (IF lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and (page_table_at' (a && ~~ mask ptBits) and (\<lambda>_. is_aligned a 6) and ((\<lambda>b. (page_table_at' (a && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> True) and K (is_aligned a 6)))\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and ?R15233 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' err) (?Q''15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (return (Inl err)) (return_void_C;;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C rv');;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C rv') (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C rv' +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C rv')));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C rv'} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C rv'),ptr_val (ptSlot_C rv' +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C rv') (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and (page_table_at' (a && ~~ mask ptBits) and (\<lambda>_. is_aligned a 6) and ((\<lambda>b. (page_table_at' (a && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> True) and K (is_aligned a 6)))\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''15225 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and ?R15233 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?QE15225 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' err) (?P'16662 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) [SKIP] (return (Inl err)) return_void_C
 2. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16661 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) return_void_C {},UNIV
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and (page_table_at' (a && ~~ mask ptBits) and (\<lambda>_. is_aligned a 6) and ((\<lambda>b. (page_table_at' (a && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> True) and K (is_aligned a 6)))\<rbrace>, \<lbrace>?QE15225 pptra vptra asida page_size addr pdPtr pd'\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> ?P'16662 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s) \<inter> ?R'16661 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; lookupPTSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (lookupPTSlot_ret_C.status_C rv') lu_ret___struct_lookupPTSlot_ret_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16661 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (addrFromPPtr pptr) pdPtr pd' err rv' lu_ret___struct_lookupPTSlot_ret_C) return_void_C {},UNIV
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and (page_table_at' (a && ~~ mask ptBits) and (\<lambda>_. is_aligned a 6) and ((\<lambda>b. (page_table_at' (a && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> True) and K (is_aligned a 6)))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'16661 pptra vptra asida page_size addr pdPtr pd' err (lu_ret___struct_lookupPTSlot_ret_C_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and ?R15233 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>?R15233 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr\<rbrace> lookupPTSlot pdPtr vptr \<lbrace>\<lambda>a. (\<lambda>a. True) and (page_table_at' (a && ~~ mask ptBits) and (\<lambda>_. is_aligned a 6) and ((\<lambda>b. (page_table_at' (a && ~~ mask ptBits) b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> True) and K (is_aligned a 6)))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) {s. (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) = pte_Ptr rv \<longrightarrow> s \<in> UNIV \<inter> UNIV)) \<and> (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (lookupPTSlot_ret_C.status_C (lu_ret___struct_lookupPTSlot_ret_C_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and ?R15233 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> ?R'15226 pptra vptra asida page_size rv' addr rv (find_ret_' s)}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMLargePage \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMLargePage = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMLargePage \<noteq> Kernel_C.ARMSmallPage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15226 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) () (addrFromPPtr pptr) pdPtr pd') \<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pde_Ptr pdPtr,vptr) UNIV
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. \<forall>v. sa\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> ?R'15226 pptra vptra asida page_size rv' addr rv (find_ret_' s)}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (9 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R15132 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T15134 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 6. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 7. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> ?R15132 pptra vptra asida page_size rv' addr a b))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> ?T15134 pptra vptra asida page_size rv' addr rv (find_ret_' s))})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q16770 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?S16773 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?Q16770 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?S16773 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q16770 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?S16773 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init pd_' pd_'_update;;
(\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?Q16770 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?S16773 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q16770 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'16849 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update pd \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd);;
CALL cleanByVA_PoU_'proc(ptr_val pd,\<acute>ret__unsigned_long))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?Q16770 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'16849 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q16770 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr) (?G'16849 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr));
liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update pd \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd);;
CALL cleanByVA_PoU_'proc(ptr_val pd,\<acute>ret__unsigned_long))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?Q16770 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'16849 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q16770 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr) (?G'16849 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr))) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr));
liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?Q16770 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'16849 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q16770 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr) (?G'16849 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr))) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr));
liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?Q16770 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'16849 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd pde \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> (\<exists>pde'. cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)) = Some pde' \<and> cpde_relation pde pde') \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI {s. (\<sigma>, s) \<in> rf_sr \<and> (isSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr},{s. (\<sigma>, s) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr)}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long)))) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17250 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd pde \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> {s. True \<and> (\<exists>pde'. cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)) = Some pde' \<and> cpde_relation pde pde') \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr) \<and> (\<forall>t. ret__unsigned_' t = pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))) \<longrightarrow> (pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))) \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr)) \<and> (pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr) \<and> (\<forall>t. ret__unsigned_' t = size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<longrightarrow> (size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<noteq> 0 \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr)) \<and> (size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) = 0 \<longrightarrow> s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr) \<and> (\<forall>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<longrightarrow> (pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr)) \<and> (pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSectionPDE pde \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr))))))}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long)))) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17250 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' pde \<sigma> x pde' t. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; sz = Wellformed_C.ARMSection; (\<sigma>, x) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMSection; vptr < pptrBase; cslift x (pde_Ptr (lookup_pd_slot pdPtr vptr)) = Some pde'; cpde_relation pde pde'; ret__unsigned_' t = pde_get_tag pde'\<rbrakk> \<Longrightarrow> (pde_get_tag pde' \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> isSectionPDE pde \<longrightarrow> pdeFrame pde \<noteq> addrFromPPtr pptr) \<and> (pde_get_tag pde' = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift pde')) \<longrightarrow> (size_CL (pde_pde_section_lift pde') \<noteq> 0 \<longrightarrow> isSectionPDE pde \<longrightarrow> pdeFrame pde \<noteq> addrFromPPtr pptr) \<and> (size_CL (pde_pde_section_lift pde') = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift pde')) \<longrightarrow> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde') \<noteq> addrFromPPtr pptr \<longrightarrow> isSectionPDE pde \<longrightarrow> pdeFrame pde \<noteq> addrFromPPtr pptr) \<and> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde') = addrFromPPtr pptr \<longrightarrow> isSectionPDE pde \<and> pdeFrame pde = addrFromPPtr pptr)))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long)))) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17250 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pd_C pd'_ = pde_Ptr pdPtr_; findPDForASID_ret_C.status_C pd'_ = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; sz = Wellformed_C.ARMSection; (\<sigma>_, x_) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMSection; vptr < pptrBase; cslift x_ (pde_Ptr (lookup_pd_slot pdPtr_ vptr)) = Some pde'_; cpde_relation pde_ pde'_; ret__unsigned_' t_ = pde_get_tag pde'_\<rbrakk> \<Longrightarrow> (pde_get_tag pde'_ \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> isSectionPDE pde_ \<longrightarrow> pdeFrame pde_ \<noteq> addrFromPPtr pptr) \<and> (pde_get_tag pde'_ = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift pde'_)) \<longrightarrow> (size_CL (pde_pde_section_lift pde'_) \<noteq> 0 \<longrightarrow> isSectionPDE pde_ \<longrightarrow> pdeFrame pde_ \<noteq> addrFromPPtr pptr) \<and> (size_CL (pde_pde_section_lift pde'_) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift pde'_)) \<longrightarrow> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde'_) \<noteq> addrFromPPtr pptr \<longrightarrow> isSectionPDE pde_ \<longrightarrow> pdeFrame pde_ \<noteq> addrFromPPtr pptr) \<and> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde'_) = addrFromPPtr pptr \<longrightarrow> isSectionPDE pde_ \<and> pdeFrame pde_ = addrFromPPtr pptr))) proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long)))) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17250 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)) (?d'17250 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17250 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od)) (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q17250 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?Q'17250 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) () rv') [SKIP] (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od) (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q17250 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?Q'17250 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) () rv') [] (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od) (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) \<acute>ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'17250 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q17250 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?G'17369 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) () rv' ret__struct_pde_C) [] (do y <- storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE;
doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) ret__struct_pde_C)));;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long)))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q17250 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> ?G'17369 pptra vptra asida page_size addr pdPtr pd' pd (theRight v) a va})
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P17498 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?G'17369 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) () rv' ret__struct_pde_C) [] (storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr)) ret__struct_pde_C))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y) (?Q'17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a) [] (doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<lbrace>?R17496 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE \<lbrace>?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. ?P17498 pptra vptra asida page_size addr pdPtr pd' pd a and ?R17496 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> ?G'17369 pptra vptra asida page_size addr pdPtr pd' pd (theRight v) a va})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> cpde_relation ARM_H.InvalidPDE ret__struct_pde_C
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y) (?Q'17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a) [] (doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<lbrace>?R17496 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE \<lbrace>?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. (\<lambda>a. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptra && mask pdBits)) and ?R17496 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y) (?Q'17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a) [] (doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<lbrace>?R17496 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE \<lbrace>?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. (\<lambda>a. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptra && mask pdBits)) and ?R17496 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid; dc y rv'a; ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y) (?G'17511 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a ret__unsigned_long) [] (doMachineOp (cleanByVA_PoU (lookup_pd_slot pdPtr vptr) (addrFromPPtr (lookup_pd_slot pdPtr vptr)))) (CALL cleanByVA_PoU_'proc(lookup_pd_slot pdPtr vptr,ret__unsigned_long))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<lbrace>?R17496 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE \<lbrace>?Q17492 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'17511 pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C y rv'a v})
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. (\<lambda>a. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptra && mask pdBits)) and ?R17496 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> \<lbrace>?R17496 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> storePDE (lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. paddr_'_update (\<lambda>_. v) (vaddr_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s) \<in> \<lbrace>\<acute>vaddr = lookup_pd_slot pdPtr vptr\<rbrace> \<inter> \<lbrace>\<acute>paddr = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrace>}})
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. (\<lambda>a. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptra && mask pdBits)) and ?R17496 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' ret__struct_pde_C. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'a. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. paddr_'_update (\<lambda>_. v) (vaddr_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s) \<in> \<lbrace>\<acute>vaddr = lookup_pd_slot pdPtr vptr\<rbrace> \<inter> \<lbrace>\<acute>paddr = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrace>}})
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. (\<lambda>a. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptra && mask pdBits)) and (\<lambda>a. True)\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. (\<lambda>a. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptra && mask pdBits)) and (\<lambda>a. True)\<rbrace>, -
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R17255 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a b. valid_pde_mapping_offset' (lookup_pd_slot pdPtr vptr && mask pdBits)\<rbrace>, -
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and ?R17255 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSection \<noteq> Kernel_C.ARMLargePage; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va. pde_pde_invalid_lift va = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1, \<dots> = theRight v\<rparr> \<and> pde_get_tag va = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := va\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptra = lookup_pd_slot pdPtr vptra\<rbrace>})
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (9 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R16769 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T16771 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 6. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 7. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ?R16769 pptra vptra asida page_size rv' addr a b)))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> ?T16771 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?S17593 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?S17593 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?S17593 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init pd_' pd_'_update;;
(lvar_nondet_init i_' i_'_update;;
(\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?S17593 pptra vptra asida page_size rv' addr rv (find_ret_' s)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17650 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (lvar_nondet_init i_' i_'_update;;
(\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> ?G'17650 pptra vptra asida page_size rv' addr rv (find_ret_' s)}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17669 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>pd :== CALL lookupPDSlot_'proc(pde_Ptr pdPtr,vptr);;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> ?G'17669 pptra vptra asida page_size rv' addr rv (find_ret_' s)}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val pd,ptr_val (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'17692 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val pd,ptr_val (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd \<noteq> pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val pd,ptr_val (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'17692 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd \<noteq> pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val pd,ptr_val (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val pd,ptr_val (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'17692 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd' pd \<inter> (if pd = pde_Ptr (lookup_pd_slot pdPtr vptr) then UNIV else {})) [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pd);;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val pd,ptr_val (pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'17692 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr))) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr));
liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
(IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
(\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
(IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'17692 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q17590 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr) (?G'17692 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr))) [SKIP] (doE y <- checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr));
liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)
odE) (\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?Q17590 pptra vptra asida page_size rv' addr a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {sa. \<forall>v. pd_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v. i_'_update (\<lambda>_. v) sa \<in> {sa. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) sa)))) \<longrightarrow> pd_'_update (\<lambda>_. v) sa \<in> {sa. sa \<in> ?G'17692 pptra vptra asida page_size rv' addr rv (find_ret_' s) v}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd pde \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> (\<exists>pde'. cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)) = Some pde' \<and> cpde_relation pde pde') \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pdPtr vptr));;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI {s. (\<sigma>, s) \<in> rf_sr \<and> (isSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr},{s. (\<sigma>, s) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSuperSection) \<and> pdeFrame pde = addrFromPPtr pptr)}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q18267 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd pde \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> {s. True \<and> (\<exists>pde'. cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)) = Some pde' \<and> cpde_relation pde pde') \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr) \<and> (\<forall>t. ret__unsigned_' t = pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))) \<longrightarrow> (pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))) \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde) \<and> pdeFrame pde = addrFromPPtr pptr)) \<and> (pde_get_tag (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr) \<and> (\<forall>t. ret__unsigned_' t = size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<longrightarrow> (size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<noteq> 1 \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde) \<and> pdeFrame pde = addrFromPPtr pptr)) \<and> (size_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) = 1 \<longrightarrow> s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr) \<and> (\<forall>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<longrightarrow> (pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) \<noteq> addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> \<not> ((isSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde) \<and> pdeFrame pde = addrFromPPtr pptr)) \<and> (pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s (pde_Ptr (lookup_pd_slot pdPtr vptr))))) = addrFromPPtr pptr \<longrightarrow> (\<sigma>, s\<lparr>ret__unsigned_' := addrFromPPtr pptr\<rparr>) \<in> rf_sr \<and> (isSectionPDE pde \<and> Wellformed_C.ARMSuperSection = Wellformed_C.ARMSection \<or> isSuperSectionPDE pde) \<and> pdeFrame pde = addrFromPPtr pptr))))))}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q18267 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' pde \<sigma> x pde' t. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; (\<sigma>, x) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; cslift x (pde_Ptr (lookup_pd_slot pdPtr vptr)) = Some pde'; cpde_relation pde pde'; ret__unsigned_' t = pde_get_tag pde'\<rbrakk> \<Longrightarrow> (pde_get_tag pde' \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> isSuperSectionPDE pde \<longrightarrow> pdeFrame pde \<noteq> addrFromPPtr pptr) \<and> (pde_get_tag pde' = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift pde')) \<longrightarrow> (size_CL (pde_pde_section_lift pde') \<noteq> 1 \<longrightarrow> isSuperSectionPDE pde \<longrightarrow> pdeFrame pde \<noteq> addrFromPPtr pptr) \<and> (size_CL (pde_pde_section_lift pde') = 1 \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift pde')) \<longrightarrow> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde') \<noteq> addrFromPPtr pptr \<longrightarrow> isSuperSectionPDE pde \<longrightarrow> pdeFrame pde \<noteq> addrFromPPtr pptr) \<and> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde') = addrFromPPtr pptr \<longrightarrow> isSuperSectionPDE pde \<and> pdeFrame pde = addrFromPPtr pptr)))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q18267 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pd_C pd'_ = pde_Ptr pdPtr_; findPDForASID_ret_C.status_C pd'_ = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; (\<sigma>_, x_) \<in> rf_sr; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; cslift x_ (pde_Ptr (lookup_pd_slot pdPtr_ vptr)) = Some pde'_; cpde_relation pde_ pde'_; ret__unsigned_' t_ = pde_get_tag pde'_\<rbrakk> \<Longrightarrow> (pde_get_tag pde'_ \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> isSuperSectionPDE pde_ \<longrightarrow> pdeFrame pde_ \<noteq> addrFromPPtr pptr) \<and> (pde_get_tag pde'_ = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift pde'_)) \<longrightarrow> (size_CL (pde_pde_section_lift pde'_) \<noteq> 1 \<longrightarrow> isSuperSectionPDE pde_ \<longrightarrow> pdeFrame pde_ \<noteq> addrFromPPtr pptr) \<and> (size_CL (pde_pde_section_lift pde'_) = 1 \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift pde'_)) \<longrightarrow> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde'_) \<noteq> addrFromPPtr pptr \<longrightarrow> isSuperSectionPDE pde_ \<longrightarrow> pdeFrame pde_ \<noteq> addrFromPPtr pptr) \<and> (pde_pde_section_CL.address_CL (pde_pde_section_lift pde'_) = addrFromPPtr pptr \<longrightarrow> isSuperSectionPDE pde_ \<and> pdeFrame pde_ = addrFromPPtr pptr))) proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))))) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q18267 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)) (?d'18267 pptra vptra asida page_size addr pdPtr pd' pd rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?Q18267 pptra vptra asida page_size addr pdPtr pd' pd rv) (?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd rv rv') [SKIP] (liftM Inr (do _ <- mapM_x (swp storePDE ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od)) (\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (While \<lbrace>\<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 4))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,lookup_pd_slot pdPtr vptr + 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) * 4 - 1,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and ?R18272 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18267 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?Q'18267 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) () rv') [SKIP] (do _ <- mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od) (\<acute>i :== 0;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV (While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'18267 pptra vptra asida page_size addr pdPtr pd' pd (theRight v))
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and ?R18272 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18267 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?G'18376 pdPtr pd' rv' rv'a) [SKIP] (do _ <- mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]);
doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>?Q18267 pptra vptra asida page_size addr pdPtr pd' pd\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'18375 pptra vptra asida page_size addr pdPtr pd' pd (theRight v) a})
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and ?R18272 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' rv'. ?G'18376 pdPtr pd' rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd'. ?G'18375 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres (?r'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?xf'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?P18507 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?G'18376 pdPtr pd' rv' rv'a) [] (mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); ?r'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?xf'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. ?P18507 pptra vptra asida page_size addr pdPtr pd' pd a and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'18375 pptra vptra asida page_size addr pdPtr pd' pd (theRight v) a})
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' rv'. ?G'18376 pdPtr pd' rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd'. ?G'18375 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> ccorres (?r'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?xf'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?G18517 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()) (?G'18376 pdPtr pd' rv' rv'a) [] (mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); ?r'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?xf'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. ?G18517 pptra vptra asida page_size addr pdPtr pd' pd a and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> ?G'18375 pptra vptra asida page_size addr pdPtr pd' pd (theRight v) a})
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>pdPtr pd' rv'. ?G'18376 pdPtr pd' rv' () \<equiv>\<^sup>? \<lambda>pdPtr pd'. ?G'18375 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>n<length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). ccorres dc xfdc (page_directory_at' pdPtr) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE) (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (page_directory_at' pdPtr) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (storePDE ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE) (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pdPtr pd' n. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q18536 pdPtr pd' n) (?Q'18536 pdPtr pd' n) [] (storePDE ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE) (\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))))
 2. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q18536 pdPtr pd' n s \<and> s' \<in> ?Q'18536 pdPtr pd' n
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pdPtr pd' n ret__struct_pde_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q18536 pdPtr pd' n) (?G'18542 pdPtr pd' n ret__struct_pde_C) [] (storePDE ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) ret__struct_pde_C))))))
 2. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q18536 pdPtr pd' n s \<and> s' \<in> {s. \<forall>v. pde_pde_invalid_lift v = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1\<rparr> \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := v\<rparr> \<in> ?G'18542 pdPtr pd' n v}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pdPtr pd' n ret__struct_pde_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A18615 pdPtr pd' n) (?C'18612 pdPtr pd' n ret__struct_pde_C) [] (storePDE ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) ret__struct_pde_C)))))
 2. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?A18615 pdPtr pd' n and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection)) s \<and> s' \<in> {s. \<forall>v. pde_pde_invalid_lift v = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1\<rparr> \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := v\<rparr> \<in> ?C'18612 pdPtr pd' n v \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pdPtr pd' n ret__struct_pde_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A18623 pdPtr pd' n) (?C'18620 pdPtr pd' n ret__struct_pde_C) [] (storePDE ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr) ARM_H.InvalidPDE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) ret__struct_pde_C))))
 2. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?A18623 pdPtr pd' n and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection)) s \<and> s' \<in> {s. \<forall>v. pde_pde_invalid_lift v = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1\<rparr> \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := v\<rparr> \<in> ?C'18620 pdPtr pd' n v \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pdPtr pd' n ret__struct_pde_C. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; pde_pde_invalid_lift ret__struct_pde_C = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag ret__struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid\<rbrakk> \<Longrightarrow> cpde_relation ARM_H.InvalidPDE ret__struct_pde_C
 2. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. valid_pde_mapping_offset' ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr && mask pdBits)) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection)) s \<and> s' \<in> {s. \<forall>v. pde_pde_invalid_lift v = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1\<rparr> \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := v\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptr + \<acute>i * 4 = [0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr\<rbrace> \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>a. valid_pde_mapping_offset' ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr && mask pdBits)) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection)) s \<and> s' \<in> {s. \<forall>v. pde_pde_invalid_lift v = \<lparr>stored_hw_asid_CL = stored_hw_asid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 8, stored_asid_valid_CL = stored_asid_valid_' (stored_asid_valid_'_update (\<lambda>_. 0) (stored_hw_asid_'_update (\<lambda>_. 0) s)) && mask 1\<rparr> \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> s\<lparr>ret__struct_pde_C_' := v\<rparr> \<in> \<lbrace>lookup_pd_slot pdPtr vptr + \<acute>i * 4 = [0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr\<rbrace> \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> unat \<acute>i \<noteq> 0)\<rbrace>}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < length [0 , 4 .e. 0x3C]; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' ([0 , 4 .e. 0x3C] ! n + lookup_pd_slot pdPtr vptr && mask pdBits) \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection \<and> ((\<exists>v. pde_pde_invalid_lift v = \<lparr>stored_hw_asid_CL = 0, stored_asid_valid_CL = 0\<rparr> \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid) \<longrightarrow> word_of_nat n * 4 = [0 , 4 .e. 0x3C] ! n \<and> unat (word_of_nat n) \<le> 15 \<and> unat (word_of_nat n) \<le> 16 \<and> (word_of_nat n \<noteq> 0 \<longrightarrow> 0 < unat (word_of_nat n)))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; n < 16; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' (word_of_nat n * 4 + lookup_pd_slot pdPtr vptr && mask pdBits) \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; is_aligned vptr 24; vptr < pptrBase; n < 16; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' (word_of_nat n * 4 + lookup_pd_slot pdPtr vptr && mask pdBits)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; is_aligned vptr 24; vptr < pptrBase; n < 16; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' (word_of_nat n * 4 + (vptr >> 20 << 2) && mask pdBits)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (21 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; is_aligned vptr 24; n < 16; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> word_of_nat n = 0 \<or> is_aligned vptr 24
 2. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; is_aligned vptr 24; n < 16; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> word_of_nat n \<le> 0xF
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
A total of 21 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (20 subgoals):
 1. \<And>pdPtr pd' n s s'. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; is_aligned vptr 24; n < 16; (s, s') \<in> rf_sr; page_directory_at' pdPtr s; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> word_of_nat n \<le> 0xF
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
A total of 20 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (19 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
A total of 19 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_Ptr (lookup_pd_slot pdPtr vptr + \<acute>i * 4)) \<acute>ret__struct_pde_C))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (18 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. \<forall>t. pde_pde_invalid_lift (ret__struct_pde_C_' t) = \<lparr>stored_hw_asid_CL = 0 && mask 8, stored_asid_valid_CL = 0 && mask 1\<rparr> \<and> pde_get_tag (ret__struct_pde_C_' t) = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (unat (i_' sa)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + i_' sa * 4) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) (Suc (unat (i_' sa))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = i_' s}
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
A total of 18 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (17 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; Suc n < length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pdPtr\<rbrace> storePDE (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C] ! n) ARM_H.InvalidPDE \<lbrace>\<lambda>_. page_directory_at' pdPtr\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 10. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 17 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) < 2 ^ word_bits
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (?d'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv'b)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> dc xfdc (inl_rrel dc \<circ> Inr) xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [SKIP] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (?Q'18501 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A18815 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?C'18812 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) (lookup_pd_slot pdPtr vptr));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A18815 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a a and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. ?C'18812 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A18815 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?G'18822 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C)} (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A18815 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a a and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'18822 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b v} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A18958 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?C'18955 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))))) (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A18958 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a a and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?C'18955 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b v \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A18958 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv) (?C'18955 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long) [] (doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))) >>= return) (CALL cleanCacheRange_PoU_'proc(lookup_pd_slot pdPtr vptr,0x3F + lookup_pd_slot pdPtr vptr,ret__unsigned_long);;
Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. ?A18958 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a a and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?C'18955 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b v \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long rva xfdca. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr); dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q18966 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long rva) (?Q'18966 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long rva xfdca) [] (return rva) (Guard MemorySafety \<lbrace>array_assertion (pde_Ptr (lookup_pd_slot pdPtr vptr)) 15 (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18970 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv\<rbrace> doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))) \<lbrace>?Q18966 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and ?R18970 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a a and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'18966 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b v rva (xfdc t)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv rv'b ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); rv'b = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])); ret__unsigned_long = addrFromPPtr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18970 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv\<rbrace> doMachineOp (cleanCacheRange_PoU (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3) (addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection)\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and ?R18970 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a a and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18505 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ?R18505 pptra vptra asida page_size addr pdPtr pd' pd a\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'19037 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>\<lambda>a. (\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and (?P'19037 pptra vptra asida page_size addr pdPtr pd' pd a and K (is_aligned pdPtr pdBits))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'19037 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q19039 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; ?Q19039 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and (?P'19037 pptra vptra asida page_size addr pdPtr pd' pd a and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?P19045 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'19044 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q'19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; ?Q19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s \<and> ?Q'19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>b. ?P19045 pptra vptra asida page_size addr pdPtr pd' pd a b \<and> ?P'19044 pptra vptra asida page_size addr pdPtr pd' pd a b) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv s. page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'19044 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q'19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> ?Q'19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>b. (page_directory_at' pdPtr b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> ?P'19044 pptra vptra asida page_size addr pdPtr pd' pd a b) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'19044 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) ()\<rbrace> mapM_x (\<lambda>a. storePDE a ARM_H.InvalidPDE) (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<lbrace>?Q'19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> ?Q'19043 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>b. (page_directory_at' pdPtr b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b) \<and> ?P'19044 pptra vptra asida page_size addr pdPtr pd' pd a b) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. ?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a y\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. ?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a y\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). ?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' x. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> (\<lambda>x. x + lookup_pd_slot pdPtr vptr) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> setObject x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. ?P19057 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (addrFromPPtr pptr) pdPtr pd' (pde_Ptr (lookup_pd_slot pdPtr vptr)) rv' () x\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a y\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. ?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a y\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). ?P19057 pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (16 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' x ko uu_ xa y n. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> (\<lambda>x. x + lookup_pd_slot pdPtr vptr) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> updateObject ARM_H.InvalidPDE ko x y n uu_ = updateObject_default ARM_H.InvalidPDE ko x y n uu_
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' x v. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> (\<lambda>x. x + lookup_pd_slot pdPtr vptr) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 9. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
A total of 16 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (15 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' x v. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> (\<lambda>x. x + lookup_pd_slot pdPtr vptr) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 8. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]); y \<in> set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd x y. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; x \<in> (\<lambda>x. x + lookup_pd_slot pdPtr vptr) ` set [0 , 4 .e. 0x3C]; y \<in> (\<lambda>x. x + lookup_pd_slot pdPtr vptr) ` set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> \<lbrace>pde_at' y\<rbrace> storePDE x ARM_H.InvalidPDE \<lbrace>\<lambda>rv. pde_at' y\<rbrace>
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a rv s. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr); is_aligned pdPtr pdBits; (page_directory_at' pdPtr s \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s) \<and> (\<forall>x\<in>set (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]). obj_at' (\<lambda>a. True) x s)\<rbrakk> \<Longrightarrow> ((\<lambda>s. unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s) and (\<lambda>_. hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5) and (\<lambda>a. True \<and> page_directory_at' pdPtr a \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr + 0x3C))) and (\<lambda>s. page_directory_at' pdPtr s \<and> vmsz_aligned vptr Wellformed_C.ARMSuperSection) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr))) and pde_at' (ptr_val (pde_Ptr (lookup_pd_slot pdPtr vptr)))) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5 \<and> pde_at' (lookup_pd_slot pdPtr vptr + 0x3C) s \<and> pde_at' (lookup_pd_slot pdPtr vptr) s
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s; ?P19088 pdPtr pd' s\<rbrakk> \<Longrightarrow> unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5 \<and> pde_at' (lookup_pd_slot pdPtr vptr + 0x3C) s \<and> pde_at' (lookup_pd_slot pdPtr vptr) s
 2. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> ?P19088 pdPtr pd' s
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s; [0 , 4 .e. 0x3C] \<noteq> []; obj_at' (\<lambda>a. True) (hd [0 , 4 .e. 0x3C] + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5 \<and> pde_at' (lookup_pd_slot pdPtr vptr + 0x3C) s \<and> pde_at' (lookup_pd_slot pdPtr vptr) s
 2. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s; [0 , 4 .e. 0x3C] \<noteq> []; obj_at' (\<lambda>a. True) (hd [0 , 4 .e. 0x3C] + lookup_pd_slot pdPtr vptr) s; obj_at' (\<lambda>a. True) (last [0 , 4 .e. 0x3C] + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> unat (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> gsMaxObjectSize s \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<le> last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 \<and> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<le> addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) + (last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3 - hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) \<and> hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) && mask 5 = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])) && mask 5 \<and> pde_at' (lookup_pd_slot pdPtr vptr + 0x3C) s \<and> pde_at' (lookup_pd_slot pdPtr vptr) s
 2. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr 14; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>{0..<16}. obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr + word_of_nat x * 4) s; obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr) s; obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr + 0x3C) s\<rbrakk> \<Longrightarrow> lookup_pd_slot pdPtr vptr \<le> lookup_pd_slot pdPtr vptr + 0x3F \<and> addrFromPPtr (lookup_pd_slot pdPtr vptr) \<le> addrFromPPtr (lookup_pd_slot pdPtr vptr) + 0x3F \<and> lookup_pd_slot pdPtr vptr && mask 5 = addrFromPPtr (lookup_pd_slot pdPtr vptr) && mask 5
 2. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr 14; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>{0..<16}. obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr + word_of_nat x * 4) s; obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr) s; obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr + 0x3C) s; is_aligned pdPtr 6\<rbrakk> \<Longrightarrow> lookup_pd_slot pdPtr vptr \<le> lookup_pd_slot pdPtr vptr + 0x3F \<and> addrFromPPtr (lookup_pd_slot pdPtr vptr) \<le> addrFromPPtr (lookup_pd_slot pdPtr vptr) + 0x3F \<and> lookup_pd_slot pdPtr vptr && mask 5 = addrFromPPtr (lookup_pd_slot pdPtr vptr) && mask 5
 2. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (14 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr 14; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>{0..<16}. obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr + word_of_nat x * 4) s; obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr) s; obj_at' (\<lambda>a. True) (lookup_pd_slot pdPtr vptr + 0x3C) s; is_aligned pdPtr 6; is_aligned (lookup_pd_slot pdPtr vptr) 6\<rbrakk> \<Longrightarrow> lookup_pd_slot pdPtr vptr \<le> lookup_pd_slot pdPtr vptr + 0x3F \<and> addrFromPPtr (lookup_pd_slot pdPtr vptr) \<le> addrFromPPtr (lookup_pd_slot pdPtr vptr) + 0x3F \<and> lookup_pd_slot pdPtr vptr && mask 5 = addrFromPPtr (lookup_pd_slot pdPtr vptr) && mask 5
 2. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> [0 , 4 .e. 0x3C] \<noteq> []
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 7. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 10. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
A total of 14 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (13 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; is_aligned pdPtr pdBits; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; page_directory_at' pdPtr s; is_aligned vptr 24; vptr < pptrBase; 16777216 \<le> gsMaxObjectSize s; \<forall>x\<in>set [0 , 4 .e. 0x3C]. obj_at' (\<lambda>a. True) (x + lookup_pd_slot pdPtr vptr) s\<rbrakk> \<Longrightarrow> [0 , 4 .e. 0x3C] \<noteq> []
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 6. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 9. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 10. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd rv' rv'a. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))) i_' (\<lambda>rv rv'b. {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) (lookup_pd_slot pdPtr vptr)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3F + lookup_pd_slot pdPtr vptr) (start_'_update (\<lambda>_. lookup_pd_slot pdPtr vptr) s)) \<in> \<lbrace>\<acute>start = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C])\<rbrace> \<inter> \<lbrace>\<acute>end = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) + 3\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV \<inter> {s. dc rv (xfdc s)} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace>} \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>15 \<le> 16 \<and> 15 \<noteq> 0\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and ?R18272 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (12 subgoals):
 1. \<And>pdPtr pd' s. \<lbrakk>pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; asid \<le> mask local.asid_bits; SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; sz = Wellformed_C.ARMSuperSection; vmsz_aligned' vptr Wellformed_C.ARMSuperSection; vptr < pptrBase; i_' s = word_of_nat (length [0 , 4 .e. 0x3C])\<rbrakk> \<Longrightarrow> lookup_pd_slot pdPtr vptr = hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<and> 0x3C + lookup_pd_slot pdPtr vptr = last (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]) \<and> addrFromPPtr (lookup_pd_slot pdPtr vptr) = addrFromPPtr (hd (map (\<lambda>x. x + lookup_pd_slot pdPtr vptr) [0 , 4 .e. 0x3C]))
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 5. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 8. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 9. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and ?R18272 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (11 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> \<lbrace>?R18272 (PTR(unit) pptr) vptr asid (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) () (addrFromPPtr pptr) pdPtr\<rbrace> checkMappingPPtr pptr Wellformed_C.ARMSuperSection (Inr (lookup_pd_slot pdPtr vptr)) \<lbrace>\<lambda>a. page_directory_at' pdPtr and (\<lambda>_. is_aligned pdPtr pdBits) and ((\<lambda>a. (page_directory_at' pdPtr a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a) \<and> True) and K (is_aligned pdPtr pdBits))\<rbrace>, -
 2. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 4. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 7. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 8. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and ?R18272 pptra vptra asida page_size rv' addr a) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 10. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (10 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' pd. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr Wellformed_C.ARMSuperSection \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; Wellformed_C.ARMSuperSection = sz \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSmallPage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMLargePage; Kernel_C.ARMSuperSection \<noteq> Kernel_C.ARMSection; page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection; pd = pde_Ptr (lookup_pd_slot pdPtr vptr)\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. s \<in> UNIV})
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 3. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 6. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 7. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 9. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 10. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (9 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection; page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel dc) xfdc (?R17589 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr) (?T17591 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr pd') [SKIP] (case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE) (Guard DontReach {} SKIP)
 2. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 5. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 6. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 7. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ?R17589 pptra vptra asida page_size rv' addr a b))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 8. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> page_directory_at' rv sa \<longrightarrow> s' \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> sa \<in> {sa. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> sa \<in> ?T17591 pptra vptra asida page_size rv' addr rv (find_ret_' s))})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 9. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (8 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 2. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (?d'14144 pptra vptra asida page_size addr pdPtr pd' rv')
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 4. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 5. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 6. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 7. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 8. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (7 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' y rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 pptra vptra asida page_size addr pdPtr pd' y) (?Q'14144 pptra vptra asida page_size addr pdPtr pd' y rv') [SKIP] (liftE (flushPage sz pdPtr asid vptr)) (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 4. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 5. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 6. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (7 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd' rv'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q14144 (PTR(unit) pptr) vptr asid page_size (addrFromPPtr pptr) pdPtr pd' ()) (?Q'14144 (PTR(unit) pptr) vptr asid page_size (addrFromPPtr pptr) pdPtr pd' () rv') [SKIP] (flushPage sz pdPtr asid vptr) (CALL flushPage_'proc(page_size,pde_Ptr pdPtr,asid,vptr))
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>?Q14144 pptra vptra asida page_size addr pdPtr pd'\<rbrace>, -
 3. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v. ?Q'14144 pptra vptra asida page_size addr pdPtr pd' (theRight v))
 4. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 5. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 6. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 7. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (6 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R14157 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) pdPtr\<rbrace> case sz of local.ARMSmallPage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do storePTE p ARM_H.InvalidPTE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupPTSlot pdPtr vptr;
checkMappingPPtr pptr sz (Inl p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) largePagePTEOffsets);
mapM (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do storePDE p ARM_H.InvalidPDE;
doMachineOp $ cleanByVA_PoU (VPtr $ fromPPtr p) (addrFromPPtr p)
od
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pdPtr vptr);
checkMappingPPtr pptr sz (Inr p);
withoutFailure $ do slots <- return (map (\<lambda>x. x + p) superSectionPDEOffsets);
mapM (swp storePDE ARM_H.InvalidPDE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots))
od
odE \<lbrace>\<lambda>a. invs' and (\<lambda>s. asida \<le> mask local.asid_bits \<and> is_aligned vptra pageBits)\<rbrace>, -
 2. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. vptr_'_update (\<lambda>_. vptra) (asid_'_update (\<lambda>_. asida) (pd_'_update (\<lambda>_. pde_Ptr pdPtr) (page_size_'_update (\<lambda>_. page_size) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = sz \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pdPtr\<rbrace> \<inter> \<lbrace>\<acute>asid = asida\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>})
 3. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and ?R14157 pptra vptra asida page_size rv' addr a)\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 5. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 6. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (5 subgoals):
 1. \<And>pptra vptra asida page_size addr pdPtr pd'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; pd_C pd' = pde_Ptr pdPtr; findPDForASID_ret_C.status_C pd' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel dc) xfdc (\<lambda>v a. {s. vptr_'_update (\<lambda>_. vptra) (asid_'_update (\<lambda>_. asida) (pd_'_update (\<lambda>_. pde_Ptr pdPtr) (page_size_'_update (\<lambda>_. page_size) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = sz \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pdPtr\<rbrace> \<inter> \<lbrace>\<acute>asid = asida\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>})
 2. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and (\<lambda>b. (sz = Wellformed_C.ARMSmallPage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and (\<lambda>s. valid_pde_mapping' (lookupPDSlot a vptra && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and K (\<forall>p\<in>set (map (\<lambda>x. x + lookupPDSlot a vptra) superSectionPDEOffsets). valid_pde_mapping' (p && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits)))\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (4 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 pptra vptra asida page_size rv' addr err) (?Q''12075 pptra vptra asida page_size rv' addr err rv'a find_ret) [SKIP] (throwError err) (IF findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
(IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage THEN
  lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits) DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMLargePageBits - ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>ARMLargePageBits - ARMSmallPageBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)
ELSE
  IF page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 2. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and (\<lambda>b. (sz = Wellformed_C.ARMSmallPage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and (\<lambda>s. valid_pde_mapping' (lookupPDSlot a vptra && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and K (\<forall>p\<in>set (map (\<lambda>x. x + lookupPDSlot a vptra) superSectionPDEOffsets). valid_pde_mapping' (p && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits)))\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (4 subgoals):
 1. \<And>pptra vptra asida page_size addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) err) (?Q''12075 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) err rv'a find_ret) [SKIP] (return (Inl err)) (return_void_C;;
(Cond (if page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage then UNIV else {}) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) \<acute>ret__struct_pte_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C));;
CALL cleanByVA_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),\<acute>ret__unsigned_long)) (Cond (if page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage then UNIV else {}) (lvar_nondet_init lu_ret___struct_lookupPTSlot_ret_C_' lu_ret___struct_lookupPTSlot_ret_C_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>lu_ret___struct_lookupPTSlot_ret_C :== CALL lookupPTSlot_'proc(pd_C rv'a,vptr);;
IF lookupPTSlot_ret_C.status_C \<acute>lu_ret___struct_lookupPTSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_void_C
FI;;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned_long \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMLargePageBits - ARMSmallPageBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pte_C :== CALL pte_pte_invalid_new_'proc();;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint \<acute>i) \<acute>ret__struct_pte_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s)} (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ptSlot_C (lu_ret___struct_lookupPTSlot_ret_C_' s) +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMLargePageBits - ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if ARMLargePageBits - ARMSmallPageBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMLargePageBits - sint ARMSmallPageBits \<and> sint ARMLargePageBits - sint ARMSmallPageBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C),ptr_val (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C +\<^sub>p uint (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMLargePageBits - ARMSmallPageBits) = 1 \<or> array_assertion (ptSlot_C \<acute>lu_ret___struct_lookupPTSlot_ret_C) (unat (2 ^ unat (ARMLargePageBits - ARMSmallPageBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))) (Cond (if page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then UNIV else {}) (lvar_nondet_init pd_' pd_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update \<acute>pd \<acute>ret__struct_pde_C)));;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd);;
CALL cleanByVA_PoU_'proc(ptr_val \<acute>pd,\<acute>ret__unsigned_long)) (Cond (if page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection then UNIV else {}) (lvar_nondet_init pd_' pd_'_update;;
lvar_nondet_init i_' i_'_update;;
\<acute>pd :== CALL lookupPDSlot_'proc(pd_C rv'a,vptr);;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> 1 THEN
  return_void_C
FI;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pd);;
IF \<acute>ret__unsigned \<noteq> addrFromPPtr pptr THEN
  return_void_C
FI;;
\<acute>i :== 0;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  \<acute>ret__struct_pde_C :== CALL pde_pde_invalid_new_'proc(0,0);;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion \<acute>pd (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>pd +\<^sub>p uint \<acute>i) \<acute>ret__struct_pde_C)))));;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) \<acute>pd));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pd_' s} (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pd_' s +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1))} (Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val \<acute>pd,ptr_val (\<acute>pd +\<^sub>p uint (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>2 ^ unat (ARMSuperSectionBits - ARMSectionBits) = 1 \<or> array_assertion \<acute>pd (unat (2 ^ unat (ARMSuperSectionBits - ARMSectionBits) - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)))))))) (Guard DontReach {} SKIP))));;
CALL flushPage_'proc(page_size,pd_C rv'a,asid,vptr)))
 2. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and (\<lambda>b. (sz = Wellformed_C.ARMSmallPage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and (\<lambda>s. valid_pde_mapping' (lookupPDSlot a vptra && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and K (\<forall>p\<in>set (map (\<lambda>x. x + lookupPDSlot a vptra) superSectionPDEOffsets). valid_pde_mapping' (p && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits)))\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''12075 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (5 subgoals):
 1. \<And>pptra vptra asida page_size addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?QE12075 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) err) (?P'19519 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) err rv'a find_ret) [SKIP] (return (Inl err)) return_void_C
 2. \<And>pptra vptra asida page_size addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19518 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) err rv'a find_ret) return_void_C {},UNIV
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and (\<lambda>b. (sz = Wellformed_C.ARMSmallPage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and (\<lambda>s. valid_pde_mapping' (lookupPDSlot a vptra && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and K (\<forall>p\<in>set (map (\<lambda>x. x + lookupPDSlot a vptra) superSectionPDEOffsets). valid_pde_mapping' (p && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits)))\<rbrace>, \<lbrace>?QE12075 pptra vptra asida page_size rv' addr\<rbrace>
 4. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?P'19519 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s) \<inter> ?R'19518 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 5. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (4 subgoals):
 1. \<And>pptra vptra asida page_size addr err rv'a find_ret. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr; findPDForASID_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel err (findPDForASID_ret_C.status_C rv'a) find_ret\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19518 (PTR(unit) pptr) vptr asid page_size () (addrFromPPtr pptr) err rv'a find_ret) return_void_C {},UNIV
 2. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and (\<lambda>b. (sz = Wellformed_C.ARMSmallPage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and (\<lambda>s. valid_pde_mapping' (lookupPDSlot a vptra && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and K (\<forall>p\<in>set (map (\<lambda>x. x + lookupPDSlot a vptra) superSectionPDEOffsets). valid_pde_mapping' (p && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits)))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'19518 pptra vptra asida page_size rv' addr err (find_ret_' s) (errstate s)))}
 4. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (3 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a. page_directory_at' a and ((\<lambda>b. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> True \<and> True)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_directory_at' a and (\<lambda>a. True \<and> True \<and> valid_objs' a \<and> (is_aligned vptra 16 \<and> valid_objs' a) \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> True \<and> is_aligned vptra 16 \<and> valid_objs' a)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. valid_pde_mapping_offset' (lookup_pd_slot a vptra && mask pdBits))) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> ((\<lambda>a. True) and (\<lambda>b. page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits)) b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True))))) and (\<lambda>b. (sz = Wellformed_C.ARMSmallPage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pte' ARM_H.InvalidPTE) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and (\<lambda>s. valid_pde_mapping' (lookupPDSlot a vptra && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> True \<and> True \<and> True \<and> (invs' and valid_pde' ARM_H.InvalidPDE and K (\<forall>p\<in>set (map (\<lambda>x. x + lookupPDSlot a vptra) superSectionPDEOffsets). valid_pde_mapping' (p && mask pdBits) ARM_H.InvalidPDE)) b \<and> is_aligned vptra pageBits)))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (3 subgoals):
 1. \<And>pptra vptra asida page_size addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<lbrace>?R12094 (PTR(unit) pptr) vptr asid page_size\<rbrace> findPDForASID asid \<lbrace>\<lambda>a b. page_directory_at' a b \<and> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> page_directory_at' a b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> page_directory_at' a b \<and> valid_objs' b \<and> is_aligned vptr 16 \<and> valid_objs' b \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize b \<and> is_aligned vptr 16 \<and> valid_objs' b) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> valid_pde_mapping_offset' (a + (vptr >> 20 << 2) && mask pdBits)) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> page_directory_at' a b \<and> is_aligned a pdBits \<and> page_directory_at' a b \<and> 16777216 \<le> gsMaxObjectSize b \<and> is_aligned a pdBits))) \<and> (sz = Wellformed_C.ARMSmallPage \<longrightarrow> invs' b \<and> is_aligned vptr pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> invs' b \<and> is_aligned vptr pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> invs' b \<and> is_aligned vptr pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> invs' b \<and> is_aligned vptr pageBits)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and ?R12094 pptra vptra asida page_size) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (2 subgoals):
 1. \<And>pptra vptra asida page_size rv' addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size rv' addr) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. (findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s \<longrightarrow> s' \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. \<forall>v. s\<lparr>lu_ret___struct_lookupPTSlot_ret_C_' := v\<rparr> \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s) \<in> UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr rv\<rbrace> \<inter> \<lbrace>\<acute>vptr = vptra\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> s \<in> {s. (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {s. \<forall>v. pd_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) (vptr_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))) \<longrightarrow> pd_'_update (\<lambda>_. v) s \<in> {s. s \<in> UNIV \<inter> UNIV}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vptra) (pd_'_update (\<lambda>_. pde_Ptr rv) s)))))}}}) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> s \<in> {})})})})} \<inter> UNIV})) \<and> (findPDForASID_ret_C.status_C (find_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. lookup_failure_rel err (findPDForASID_ret_C.status_C (find_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. True \<and> True \<and> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> True) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> True \<and> valid_objs' a \<and> is_aligned vptra 16 \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> is_aligned vptra 16 \<and> valid_objs' a) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (valid_objs' and K (vptra < pptrBase)) a) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True \<and> valid_objs' a \<and> True \<and> 16777216 \<le> gsMaxObjectSize a \<and> valid_objs' a))) \<and> (sz = Wellformed_C.ARMSmallPage \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> invs' a \<and> is_aligned vptra pageBits))) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (2 subgoals):
 1. \<And>pptra vptra asida page_size addr. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; addr = addrFromPPtr pptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12090 page_size () (addrFromPPtr pptr)) \<acute>find_ret :== CALL findPDForASID_'proc(asid) {s. findPDForASID_ret_C.status_C (find_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (find_ret_' s) = pde_Ptr rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> page_directory_at' rv sa) \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> array_assertion (pde_Ptr rv) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> array_assertion (pde_Ptr rv) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))) \<and> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection))}
 2. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. True \<and> True \<and> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> True) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> True \<and> valid_objs' a \<and> is_aligned vptra 16 \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> is_aligned vptra 16 \<and> valid_objs' a) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (valid_objs' and K (vptra < pptrBase)) a) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True \<and> valid_objs' a \<and> True \<and> 16777216 \<le> gsMaxObjectSize a \<and> valid_objs' a))) \<and> (sz = Wellformed_C.ARMSmallPage \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> invs' a \<and> is_aligned vptra pageBits))) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> ?R'12086 pptra vptra asida page_size v}}
flex-flex pairs:
\<lambda>page_size. ?R'12090 page_size () \<equiv>\<^sup>? ?R'12086 (PTR(unit) pptr) vptr asid proof (prove)
goal (1 subgoal):
 1. \<And>pptra vptra asida page_size s s'. \<lbrakk>asid \<le> mask local.asid_bits \<and> vmsz_aligned' vptr sz \<and> vptr < pptrBase; pptra = PTR(unit) pptr; vptra = vptr; asida = asid; gen_framesize_to_H page_size = sz \<and> page_size < 4; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_arch_state' and no_0_obj' and (\<lambda>_. asida \<le> mask local.asid_bits) and (\<lambda>a. True \<and> True \<and> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> True) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> True \<and> valid_objs' a \<and> is_aligned vptra 16 \<and> valid_objs' a \<and> 2 ^ pageBitsForSize sz \<le> gsMaxObjectSize a \<and> is_aligned vptra 16 \<and> valid_objs' a) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (valid_objs' and K (vptra < pptrBase)) a) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> True \<and> valid_objs' a \<and> True \<and> 16777216 \<le> gsMaxObjectSize a \<and> valid_objs' a))) \<and> (sz = Wellformed_C.ARMSmallPage \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMLargePage \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSection \<longrightarrow> invs' a \<and> is_aligned vptra pageBits) \<and> (sz = Wellformed_C.ARMSuperSection \<longrightarrow> invs' a \<and> is_aligned vptra pageBits))) s \<and> s' \<in> {s. s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. pptra) s))) \<longrightarrow> addr_'_update (\<lambda>_. v) s \<in> {s. asid_'_update (\<lambda>_. asida) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asida\<rbrace>} \<inter> {s. \<forall>t. findPDForASID_ret_C.status_C (ret__struct_findPDForASID_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (ret__struct_findPDForASID_ret_C_' t) = pde_Ptr rv \<longrightarrow> (\<exists>sa. (sa, find_ret_'_update (\<lambda>_. ret__struct_findPDForASID_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> page_directory_at' rv sa) \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> array_assertion (pde_Ptr rv) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> array_assertion (pde_Ptr rv) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))) \<and> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection))}}} proof (prove)
goal (1 subgoal):
 1. \<And>page_size s s'. \<lbrakk>(s, s') \<in> rf_sr; asid \<le> mask local.asid_bits; page_size < 4; sz = gen_framesize_to_H page_size; invs' s; 2 ^ pageBitsForSize (gen_framesize_to_H page_size) \<le> gsMaxObjectSize s; is_aligned vptr (pageBitsForSize (gen_framesize_to_H page_size)); vptr < pptrBase\<rbrakk> \<Longrightarrow> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> is_aligned vptr 16) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> 16777216 \<le> gsMaxObjectSize s)) \<and> (\<forall>t. findPDForASID_ret_C.status_C (ret__struct_findPDForASID_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. pd_C (ret__struct_findPDForASID_ret_C_' t) = pde_Ptr rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> page_directory_at' rv s) \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<longrightarrow> page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> array_assertion (pde_Ptr rv) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s')))) \<and> (page_size \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<longrightarrow> (page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection \<longrightarrow> array_assertion (pde_Ptr rv) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s')))) \<and> page_size = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)))