theory Retype_C

lemma Arch_createObject_ccorres:
  assumes t: "toAPIType newType = None"
  shows "ccorres (\<lambda>a b. ccap_relation (ArchObjectCap a) b) ret__struct_cap_C_'
     (createObject_hs_preconds regionBase newType userSize deviceMemory)
     (createObject_c_preconds regionBase newType userSize deviceMemory)
     []
     (Arch.createObject newType regionBase userSize deviceMemory)
     (Call Arch_createObject_'proc)" proof - note if_cong[cong] show ?thesis apply (clarsimp simp: createObject_c_preconds_def
                          createObject_hs_preconds_def) apply (rule ccorres_gen_asm) apply clarsimp apply (frule range_cover.aligned) apply (cut_tac t) apply (case_tac newType,
           simp_all add: toAPIType_def
               bind_assoc
               ARMLargePageBits_def) apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_') apply (simp add: object_type_from_H_def Kernel_C_defs) apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff
                      ARMLargePageBits_def ARMSmallPageBits_def
                      ARMSectionBits_def ARMSuperSectionBits_def asidInvalid_def
                      sle_positive APIType_capBits_def shiftL_nat objBits_simps
                      ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def
                      fold_eq_0_to_bool) apply (ccorres_remove_UNIV_guard) apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def
            ARM_H.createObject_def pageBits_def
            cond_second_eq_seq_ccorres modify_gsUserPages_update
            intro!: ccorres_rhs_assoc) apply ((rule ccorres_return_C | simp | wp | vcg
            | (rule match_ccorres, ctac add:
                    placeNewDataObject_ccorres[where us=0 and newType=newType, simplified]
                    gsUserPages_update_ccorres[folded modify_gsUserPages_update])
            | (rule match_ccorres, csymbr))+)[1] apply (intro conjI) apply (clarsimp simp: createObject_hs_preconds_def
                                APIType_capBits_def pageBits_def) apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def
                    framesize_to_H_def cap_to_H_simps cap_small_frame_cap_lift
                    vmrights_to_H_def mask_def vm_rights_defs)

        \<comment> \<open>Page objects: could possibly fix the duplication here\<close> apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_') apply (simp add: object_type_from_H_def Kernel_C_defs) apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff
                     ARMLargePageBits_def ARMSmallPageBits_def
                     ARMSectionBits_def ARMSuperSectionBits_def asidInvalid_def
                     sle_positive APIType_capBits_def shiftL_nat objBits_simps
                     ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def
                     fold_eq_0_to_bool) apply (ccorres_remove_UNIV_guard) apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def
           ARM_H.createObject_def pageBits_def
           cond_second_eq_seq_ccorres modify_gsUserPages_update
           intro!: ccorres_rhs_assoc) apply ((rule ccorres_return_C | simp | wp | vcg
           | (rule match_ccorres, ctac add:
                   placeNewDataObject_ccorres[where us=4 and newType=newType, simplified]
                   gsUserPages_update_ccorres[folded modify_gsUserPages_update])
           | (rule match_ccorres, csymbr))+)[1] apply (intro conjI) apply (clarsimp simp: createObject_hs_preconds_def
                               APIType_capBits_def pageBits_def) apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def
                   framesize_to_H_def cap_to_H_simps cap_frame_cap_lift
                   vmrights_to_H_def mask_def vm_rights_defs vm_page_size_defs
                   cl_valid_cap_def c_valid_cap_def
                   is_aligned_neg_mask_eq_concrete[THEN sym]) apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_') apply (simp add: object_type_from_H_def Kernel_C_defs) apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff
                    ARMLargePageBits_def ARMSmallPageBits_def
                    ARMSectionBits_def ARMSuperSectionBits_def asidInvalid_def
                    sle_positive APIType_capBits_def shiftL_nat objBits_simps
                    ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def
                    fold_eq_0_to_bool) apply (ccorres_remove_UNIV_guard) apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def
          ARM_H.createObject_def pageBits_def
          cond_second_eq_seq_ccorres modify_gsUserPages_update
          intro!: ccorres_rhs_assoc) apply ((rule ccorres_return_C | simp | wp | vcg
          | (rule match_ccorres, ctac add:
                  placeNewDataObject_ccorres[where us=8 and newType=newType, simplified]
                  gsUserPages_update_ccorres[folded modify_gsUserPages_update])
          | (rule match_ccorres, csymbr))+)[1] apply (intro conjI) apply (clarsimp simp: createObject_hs_preconds_def
                              APIType_capBits_def pageBits_def) apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def
                  framesize_to_H_def cap_to_H_simps cap_frame_cap_lift
                  vmrights_to_H_def mask_def vm_rights_defs vm_page_size_defs
                  cl_valid_cap_def c_valid_cap_def
                  is_aligned_neg_mask_eq_concrete[THEN sym]) apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_') apply (simp add: object_type_from_H_def Kernel_C_defs) apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff
                   ARMLargePageBits_def ARMSmallPageBits_def
                   ARMSectionBits_def ARMSuperSectionBits_def asidInvalid_def
                   sle_positive APIType_capBits_def shiftL_nat objBits_simps
                   ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def
                   fold_eq_0_to_bool) apply (ccorres_remove_UNIV_guard) apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def
         ARM_H.createObject_def pageBits_def
         cond_second_eq_seq_ccorres modify_gsUserPages_update
         intro!: ccorres_rhs_assoc) apply ((rule ccorres_return_C | simp | wp | vcg
         | (rule match_ccorres, ctac add:
                 placeNewDataObject_ccorres[where us=12 and newType=newType, simplified]
                 gsUserPages_update_ccorres[folded modify_gsUserPages_update])
         | (rule match_ccorres, csymbr))+)[1] apply (intro conjI) apply (clarsimp simp: createObject_hs_preconds_def
                             APIType_capBits_def pageBits_def) apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def
                 framesize_to_H_def cap_to_H_simps cap_frame_cap_lift
                 vmrights_to_H_def mask_def vm_rights_defs vm_page_size_defs
                 cl_valid_cap_def c_valid_cap_def
                 is_aligned_neg_mask_eq_concrete[THEN sym])

     \<comment> \<open>PageTableObject\<close> apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_') apply (simp add: object_type_from_H_def Kernel_C_defs) apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff
                  ARMLargePageBits_def ARMSmallPageBits_def
                  ARMSectionBits_def ARMSuperSectionBits_def asidInvalid_def
                  sle_positive APIType_capBits_def shiftL_nat objBits_simps
                  ptBits_def archObjSize_def pageBits_def word_sle_def word_sless_def) apply (ccorres_remove_UNIV_guard) apply (rule ccorres_rhs_assoc)+ apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def
        ARM_H.createObject_def pageBits_def) apply (ctac pre only: add: placeNewObject_pte[simplified]) apply csymbr apply (rule ccorres_return_C) apply simp apply simp apply simp apply wp apply vcg apply clarify apply (intro conjI) apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct' invs_valid_global'
                            APIType_capBits_def invs_queues invs_valid_objs'
                            invs_urz) apply clarsimp apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def
                framesize_to_H_def cap_to_H_simps cap_page_table_cap_lift
                is_aligned_neg_mask_eq vmrights_to_H_def
                Kernel_C.VMReadWrite_def Kernel_C.VMNoAccess_def
                Kernel_C.VMKernelOnly_def Kernel_C.VMReadOnly_def) apply (simp add: isFrameType_def)

    \<comment> \<open>PageDirectoryObject\<close> apply (cinit' lift: t_' regionBase_' userSize_' deviceMemory_') apply (simp add: object_type_from_H_def Kernel_C_defs) apply (simp add: ccorres_cond_univ_iff ccorres_cond_empty_iff
                asidInvalid_def sle_positive APIType_capBits_def shiftL_nat
                objBits_simps archObjSize_def
                ptBits_def pageBits_def pdBits_def word_sle_def word_sless_def) apply (ccorres_remove_UNIV_guard) apply (rule ccorres_rhs_assoc)+ apply (clarsimp simp: hrs_htd_update ptBits_def objBits_simps archObjSize_def
        ARM_H.createObject_def pageBits_def pdBits_def) apply (ctac pre only: add: placeNewObject_pde[simplified]) apply (ctac add: copyGlobalMappings_ccorres) apply csymbr apply (ctac add: cleanCacheRange_PoU_ccorres) apply csymbr apply (rule ccorres_return_C) apply simp apply simp apply simp apply wp apply clarsimp apply vcg apply wp apply (clarsimp simp: pageBits_def ccap_relation_def APIType_capBits_def
                  framesize_to_H_def cap_to_H_simps cap_page_directory_cap_lift
                  is_aligned_neg_mask_eq vmrights_to_H_def
                  Kernel_C.VMReadWrite_def Kernel_C.VMNoAccess_def
                  Kernel_C.VMKernelOnly_def Kernel_C.VMReadOnly_def) apply (vcg exspec=copyGlobalMappings_modifies) apply (clarsimp simp:placeNewObject_def2) apply (wp createObjects'_pde_mappings' createObjects'_page_directory_at_global[where sz=pdBits]
                createObjects'_page_directory_at'[where n=0, simplified]) apply clarsimp apply vcg apply (clarsimp simp: invs_pspace_aligned' invs_pspace_distinct'
               archObjSize_def invs_valid_global' makeObject_pde pdBits_def
               pageBits_def range_cover.aligned projectKOs APIType_capBits_def
               object_type_from_H_def objBits_simps pdeBits_def
               invs_valid_objs' isFrameType_def) apply (frule invs_arch_state') apply (frule range_cover.aligned) apply (frule is_aligned_addrFromPPtr_n, simp) apply (intro conjI, simp_all) apply fastforce apply fastforce apply (clarsimp simp: pageBits_def pdeBits_def
                             valid_arch_state'_def page_directory_at'_def pdBits_def) apply (clarsimp simp: is_aligned_no_overflow'[where n=14, simplified] pdeBits_def
                            field_simps is_aligned_mask[symmetric] mask_AND_less_0)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize deviceMemory) (createObject_c_preconds regionBase newType userSize deviceMemory) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (state)
goal (1 subgoal):
 1. ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize deviceMemory) (createObject_c_preconds regionBase newType userSize deviceMemory) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (1 subgoal):
 1. ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize deviceMemory) (createObject_c_preconds regionBase newType userSize deviceMemory) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize deviceMemory) (createObject_c_preconds regionBase newType userSize deviceMemory) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s) and (\<lambda>y. regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType))) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize; deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize; deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; is_aligned regionBase (APIType_capBits newType userSize)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize; deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; is_aligned regionBase (APIType_capBits newType userSize); toAPIType newType = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SmallPageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SmallPageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q5166 deviceMemorya userSizea regionBasea t) (?Q'5166 deviceMemorya userSizea regionBasea t) [SKIP] (Arch.createObject object_type.SmallPageObject regionBase userSize deviceMemory) (IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SmallPageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_LargePageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SuperSectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,ptr_val regionBasea + SCAST(32 signed \<rightarrow> 32) (1 << unat (0xC + 2)) - SCAST(32 signed \<rightarrow> 32) 1,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q5166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'5166 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 6\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q5166 deviceMemorya userSizea regionBasea 6) (?Q'5166 deviceMemorya userSizea regionBasea 6) [SKIP] (Arch.createObject object_type.SmallPageObject regionBase userSize deviceMemory) (Cond UNIV (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q5166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'5166 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>to_bool regionBase; {regionBase..+4096} \<inter> kernel_data_refs = {}; range_cover regionBase 12 12 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase 12; newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 6\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q5166 deviceMemorya userSizea regionBasea 6) (?Q'5166 deviceMemorya userSizea regionBasea 6) [SKIP] (Arch.createObject object_type.SmallPageObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) 12)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) 12));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q5166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'5166 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>to_bool regionBase; {regionBase..+4096} \<inter> kernel_data_refs = {}; range_cover regionBase 12 12 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase 12; newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 6\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q5166 deviceMemorya userSizea regionBasea 6) (?G'5238 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.SmallPageObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) 12)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) 12));;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q5166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'5237 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'5238 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'5237 deviceMemorya userSizea regionBasea 6 proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>to_bool regionBase; {regionBase..+4096} \<inter> kernel_data_refs = {}; range_cover regionBase 12 12 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase 12; newType = object_type.SmallPageObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q5166 deviceMemorya userSizea (PTR(unit) regionBase) 6) (?G'5238 deviceMemorya userSizea (PTR(unit) regionBase) ()) [SKIP] (do y <- placeNewDataObject regionBase 0 (to_bool deviceMemorya);
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = regionBase then Some Wellformed_C.ARMSmallPage else gsUserPages ks y\<rparr>);
return (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)
od) (Cond (if to_bool deviceMemorya then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(user_data_device_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_device_C) regionBase))))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(user_data_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_C) regionBase)))));;
(\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage regionBase 12);;
(\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if to_bool deviceMemorya then 1 else 0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q5166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'5237 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'5238 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'5237 deviceMemorya userSizea regionBasea 6 proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 0 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 0 = pageBits) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ pageBits) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ pageBits) regionBase = replicate (2 ^ pageBits) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_small_frame_cap_lift v = \<lparr>cap_small_frame_cap_CL.capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_small_frame_cap_lift v = \<lparr>cap_small_frame_cap_CL.capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 0 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 0 = pageBits) and (\<lambda>a. True)) s
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ pageBits) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ pageBits) regionBase = replicate (2 ^ pageBits) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_small_frame_cap_lift v = \<lparr>cap_small_frame_cap_CL.capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_small_frame_cap_lift v = \<lparr>cap_small_frame_cap_CL.capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)) v then UNIV else {}))}}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SmallPageObject userSize) (APIType_capBits object_type.SmallPageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SmallPageObject; is_aligned regionBase (APIType_capBits object_type.SmallPageObject userSize); newType = object_type.SmallPageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SmallPageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SmallPageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SmallPageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SmallPageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SmallPageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SmallPageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SmallPageObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ pageBits) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ pageBits) regionBase = replicate (2 ^ pageBits) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_small_frame_cap_lift v = \<lparr>cap_small_frame_cap_CL.capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_small_frame_cap_lift v = \<lparr>cap_small_frame_cap_CL.capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSmallPage None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.LargePageObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q10667 deviceMemorya userSizea regionBasea t) (?Q'10667 deviceMemorya userSizea regionBasea t) [SKIP] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SmallPageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_LargePageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SuperSectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,ptr_val regionBasea + SCAST(32 signed \<rightarrow> 32) (1 << unat (0xC + 2)) - SCAST(32 signed \<rightarrow> 32) 1,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q10667 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'10667 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 7\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q10667 deviceMemorya userSizea regionBasea 7) (?Q'10667 deviceMemorya userSizea regionBasea 7) [SKIP] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond UNIV (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q10667 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'10667 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>to_bool regionBase; {regionBase..+65536} \<inter> kernel_data_refs = {}; range_cover regionBase 16 16 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase 16; newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 7\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q10667 deviceMemorya userSizea regionBasea 7) (?Q'10667 deviceMemorya userSizea regionBasea 7) [SKIP] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) 16)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) 16));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q10667 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'10667 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>to_bool regionBase; {regionBase..+65536} \<inter> kernel_data_refs = {}; range_cover regionBase 16 16 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase 16; newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 7\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q10667 deviceMemorya userSizea regionBasea 7) (?G'10739 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.LargePageObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) 16)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) 16));;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q10667 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'10738 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'10739 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'10738 deviceMemorya userSizea regionBasea 7 proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>to_bool regionBase; {regionBase..+65536} \<inter> kernel_data_refs = {}; range_cover regionBase 16 16 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase 16; newType = object_type.LargePageObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q10667 deviceMemorya userSizea (PTR(unit) regionBase) 7) (?G'10739 deviceMemorya userSizea (PTR(unit) regionBase) ()) [SKIP] (do y <- placeNewDataObject regionBase 4 (to_bool deviceMemorya);
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = regionBase then Some Wellformed_C.ARMLargePage else gsUserPages ks y\<rparr>);
return (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)
od) (Cond (if to_bool deviceMemorya then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_device_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_device_C) regionBase))))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_C) regionBase)))));;
(\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage regionBase 16);;
(\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if to_bool deviceMemorya then 1 else 0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q10667 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'10738 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'10739 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'10738 deviceMemorya userSizea regionBasea 7 proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 4 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 4 = pageBits + 4) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 4)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 4)) regionBase = replicate (2 ^ (pageBits + 4)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 4 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 4 = pageBits + 4) and (\<lambda>a. True)) s
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 4)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 4)) regionBase = replicate (2 ^ (pageBits + 4)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)) v then UNIV else {}))}}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.LargePageObject userSize) (APIType_capBits object_type.LargePageObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.LargePageObject; is_aligned regionBase (APIType_capBits object_type.LargePageObject userSize); newType = object_type.LargePageObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.LargePageObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.LargePageObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.LargePageObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.LargePageObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.LargePageObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.LargePageObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.LargePageObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 4)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 4)) regionBase = replicate (2 ^ (pageBits + 4)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 16 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMLargePage None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q16166 deviceMemorya userSizea regionBasea t) (?Q'16166 deviceMemorya userSizea regionBasea t) [SKIP] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SmallPageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_LargePageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SuperSectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,ptr_val regionBasea + SCAST(32 signed \<rightarrow> 32) (1 << unat (0xC + 2)) - SCAST(32 signed \<rightarrow> 32) 1,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q16166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'16166 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q16166 deviceMemorya userSizea regionBasea 8) (?Q'16166 deviceMemorya userSizea regionBasea 8) [SKIP] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond UNIV (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q16166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'16166 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>to_bool regionBase; {regionBase..+1048576} \<inter> kernel_data_refs = {}; range_cover regionBase 20 20 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase 20; newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q16166 deviceMemorya userSizea regionBasea 8) (?Q'16166 deviceMemorya userSizea regionBasea 8) [SKIP] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) 20)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) 20));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q16166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'16166 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>to_bool regionBase; {regionBase..+1048576} \<inter> kernel_data_refs = {}; range_cover regionBase 20 20 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase 20; newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q16166 deviceMemorya userSizea regionBasea 8) (?G'16238 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.SectionObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) 20)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) 20));;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q16166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'16237 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'16238 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'16237 deviceMemorya userSizea regionBasea 8 proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>to_bool regionBase; {regionBase..+1048576} \<inter> kernel_data_refs = {}; range_cover regionBase 20 20 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase 20; newType = object_type.SectionObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q16166 deviceMemorya userSizea (PTR(unit) regionBase) 8) (?G'16238 deviceMemorya userSizea (PTR(unit) regionBase) ()) [SKIP] (do y <- placeNewDataObject regionBase 8 (to_bool deviceMemorya);
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = regionBase then Some Wellformed_C.ARMSection else gsUserPages ks y\<rparr>);
return (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)
od) (Cond (if to_bool deviceMemorya then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_device_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_device_C) regionBase))))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_C) regionBase)))));;
(\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection regionBase 20);;
(\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if to_bool deviceMemorya then 1 else 0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q16166 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'16237 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'16238 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'16237 deviceMemorya userSizea regionBasea 8 proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 8 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 8 = pageBits + 8) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 8)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 8)) regionBase = replicate (2 ^ (pageBits + 8)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 8 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 8 = pageBits + 8) and (\<lambda>a. True)) s
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 8)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 8)) regionBase = replicate (2 ^ (pageBits + 8)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)) v then UNIV else {}))}}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SectionObject userSize) (APIType_capBits object_type.SectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SectionObject; is_aligned regionBase (APIType_capBits object_type.SectionObject userSize); newType = object_type.SectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 8)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 8)) regionBase = replicate (2 ^ (pageBits + 8)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 256 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSection None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.SuperSectionObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q21665 deviceMemorya userSizea regionBasea t) (?Q'21665 deviceMemorya userSizea regionBasea t) [SKIP] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SmallPageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_LargePageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SuperSectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,ptr_val regionBasea + SCAST(32 signed \<rightarrow> 32) (1 << unat (0xC + 2)) - SCAST(32 signed \<rightarrow> 32) 1,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q21665 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'21665 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 9\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q21665 deviceMemorya userSizea regionBasea 9) (?Q'21665 deviceMemorya userSizea regionBasea 9) [SKIP] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond UNIV (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q21665 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'21665 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>to_bool regionBase; {regionBase..+16777216} \<inter> kernel_data_refs = {}; range_cover regionBase 24 24 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase 24; newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 9\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q21665 deviceMemorya userSizea regionBasea 9) (?Q'21665 deviceMemorya userSizea regionBasea 9) [SKIP] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) 24)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) 24));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q21665 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'21665 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>to_bool regionBase; {regionBase..+16777216} \<inter> kernel_data_refs = {}; range_cover regionBase 24 24 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase 24; newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 9\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q21665 deviceMemorya userSizea regionBasea 9) (?G'21737 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.SuperSectionObject regionBase userSize deviceMemory) (Cond (if deviceMemory then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) 24)) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) 24));;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemory then 1 else 0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q21665 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'21736 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'21737 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'21736 deviceMemorya userSizea regionBasea 9 proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>to_bool regionBase; {regionBase..+16777216} \<inter> kernel_data_refs = {}; range_cover regionBase 24 24 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase 24; newType = object_type.SuperSectionObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q21665 deviceMemorya userSizea (PTR(unit) regionBase) 9) (?G'21737 deviceMemorya userSizea (PTR(unit) regionBase) ()) [SKIP] (do y <- placeNewDataObject regionBase 12 (to_bool deviceMemorya);
y <- modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = regionBase then Some Wellformed_C.ARMSuperSection else gsUserPages ks y\<rparr>);
return (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)
od) (Cond (if to_bool deviceMemorya then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_device_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_device_C) regionBase))))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_C) regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_C) regionBase)))));;
(\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection regionBase 24);;
(\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,0,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if to_bool deviceMemorya then 1 else 0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q21665 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'21736 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'21737 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'21736 deviceMemorya userSizea regionBasea 9 proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 12 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 12 = pageBits + 12) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 12)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 12)) regionBase = replicate (2 ^ (pageBits + 12)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType 12 (to_bool deviceMemorya) and (\<lambda>y. APIType_capBits newType 12 = pageBits + 12) and (\<lambda>a. True)) s
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 12)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 12)) regionBase = replicate (2 ^ (pageBits + 12)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)) v then UNIV else {}))}}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.SuperSectionObject userSize) (APIType_capBits object_type.SuperSectionObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.SuperSectionObject; is_aligned regionBase (APIType_capBits object_type.SuperSectionObject userSize); newType = object_type.SuperSectionObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.SuperSectionObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.SuperSectionObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.SuperSectionObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.SuperSectionObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.SuperSectionObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.SuperSectionObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.SuperSectionObject userSize) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (pageBits + 12)) s \<and> (\<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (pageBits + 12)) regionBase = replicate (2 ^ (pageBits + 12)) 0)} \<inter> {s. (s \<in> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_device_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_device_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)) v then UNIV else {})) \<and> (s \<notin> (if to_bool deviceMemorya then UNIV else {}) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyps 4096 (PTR(user_data_C) regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR(user_data_C) regionBase)))) s \<in> (if \<forall>v. cap_frame_cap_lift v = \<lparr>capFSize_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection && mask 2, capFMappedASIDLow_CL = 0, capFVMRights_CL = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite && mask 2, capFMappedAddress_CL = 0, capFIsDevice_CL = (if to_bool deviceMemorya then 1 else 0) && 1, capFMappedASIDHigh_CL = 0, capFBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool deviceMemorya) regionBase vmrights.VMReadWrite Wellformed_C.ARMSuperSection None)) v then UNIV else {}))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageTableObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27164 deviceMemorya userSizea regionBasea t) (?Q'27164 deviceMemorya userSizea regionBasea t) [SKIP] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SmallPageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_LargePageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SuperSectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,ptr_val regionBasea + SCAST(32 signed \<rightarrow> 32) (1 << unat (0xC + 2)) - SCAST(32 signed \<rightarrow> 32) 1,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q27164 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'27164 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 0xA\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27164 deviceMemorya userSizea regionBasea 0xA) (?Q'27164 deviceMemorya userSizea regionBasea 0xA) [SKIP] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond UNIV (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q27164 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'27164 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 0xA\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27164 deviceMemorya userSizea regionBasea 0xA) (?Q'27164 deviceMemorya userSizea regionBasea 0xA) [SKIP] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q27164 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'27164 deviceMemorya userSizea regionBasea t
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 0xA\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27164 deviceMemorya userSizea regionBasea 0xA) (?G'27236 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q27164 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'27235 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'27236 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'27235 deviceMemorya userSizea regionBasea 0xA proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 0xA\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27164 deviceMemorya userSizea regionBasea 0xA) (?G'27236 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.PageTableObject regionBase userSize deviceMemory) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
(\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q27164 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'27235 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'27236 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'27235 deviceMemorya userSizea regionBasea 0xA proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27164 deviceMemorya userSizea (PTR(unit) regionBase) 0xA) (?G'27236 deviceMemorya userSizea (PTR(unit) regionBase) ()) [SKIP] (do y <- placeNewObject regionBase makeObject 8;
return (arch_capability.PageTableCap regionBase None)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q27164 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'27235 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'27236 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'27235 deviceMemorya userSizea regionBasea 0xA proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27279 deviceMemorya userSizea rv) (?Q'27279 deviceMemorya userSizea rv xfdc) [SKIP] (return (arch_capability.PageTableCap regionBase None)) (\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R27286 deviceMemorya userSizea (PTR(unit) regionBase) 0xA\<rbrace> placeNewObject regionBase makeObject 8 \<lbrace>?Q27279 deviceMemorya userSizea\<rbrace>
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'27279 deviceMemorya userSizea rv (xfdc s)}
 4. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and ?R27286 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q27279 deviceMemorya userSizea rv) (?G'27329 deviceMemorya userSizea rv xfdc ret__struct_cap_C) [SKIP] (return (arch_capability.PageTableCap regionBase None)) (return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C))
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R27286 deviceMemorya userSizea (PTR(unit) regionBase) 0xA\<rbrace> placeNewObject regionBase makeObject 8 \<lbrace>?Q27279 deviceMemorya userSizea\<rbrace>
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = capPTIsMapped_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa)))) && mask 1, capPTMappedASID_CL = capPTMappedASID_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa)))) && mask 17, capPTMappedAddress_CL = capPTMappedAddress_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa)))) && ~~ mask 20, capPTBasePtr_CL = capPTBasePtr_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa)))) && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> ?G'27329 deviceMemorya userSizea rv (xfdc s) v}}
 4. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and ?R27286 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C s f. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> ret__struct_cap_C_' (global_exn_var_'_update f (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C\<rparr>)) = ret__struct_cap_C
 2. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C s f. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> globals (ret__struct_cap_C_'_update f s) = globals s
 3. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R27286 deviceMemorya userSizea (PTR(unit) regionBase) 0xA\<rbrace> placeNewObject regionBase makeObject 8 \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = capPTIsMapped_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 1, capPTMappedASID_CL = capPTMappedASID_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 17, capPTMappedAddress_CL = capPTMappedAddress_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 20, capPTBasePtr_CL = capPTBasePtr_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v\<rbrace>}}
 6. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and ?R27286 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 7. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C s f. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> globals (ret__struct_cap_C_'_update f s) = globals s
 2. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R27286 deviceMemorya userSizea (PTR(unit) regionBase) 0xA\<rbrace> placeNewObject regionBase makeObject 8 \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = capPTIsMapped_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 1, capPTMappedASID_CL = capPTMappedASID_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 17, capPTMappedAddress_CL = capPTMappedAddress_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 20, capPTBasePtr_CL = capPTBasePtr_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v\<rbrace>}}
 5. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and ?R27286 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 6. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc; cap_page_table_cap_lift ret__struct_cap_C = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R27286 deviceMemorya userSizea (PTR(unit) regionBase) 0xA\<rbrace> placeNewObject regionBase makeObject 8 \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = capPTIsMapped_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 1, capPTMappedASID_CL = capPTMappedASID_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 17, capPTMappedAddress_CL = capPTMappedAddress_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 20, capPTBasePtr_CL = capPTBasePtr_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v\<rbrace>}}
 4. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and ?R27286 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 5. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R27286 deviceMemorya userSizea (PTR(unit) regionBase) 0xA\<rbrace> placeNewObject regionBase makeObject 8 \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = capPTIsMapped_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 1, capPTMappedASID_CL = capPTMappedASID_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 17, capPTMappedAddress_CL = capPTMappedAddress_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 20, capPTBasePtr_CL = capPTBasePtr_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v\<rbrace>}}
 3. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and ?R27286 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 4. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase 10; newType = object_type.PageTableObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'27280 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = capPTIsMapped_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 1, capPTMappedASID_CL = capPTMappedASID_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && mask 17, capPTMappedAddress_CL = capPTMappedAddress_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 20, capPTBasePtr_CL = capPTBasePtr_' (capPTBasePtr_'_update (\<lambda>_. regionBase) (capPTMappedAddress_'_update (\<lambda>_. 0) (capPTMappedASID_'_update (\<lambda>_. 0) (capPTIsMapped_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s)))) && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v\<rbrace>}}
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> ?R'27284 deviceMemorya userSizea regionBasea t}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc)
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'27284 deviceMemorya userSizea regionBasea 0xA \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'27280 deviceMemorya userSizea regionBasea () proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject userSize) (APIType_capBits object_type.PageTableObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject userSize); newType = object_type.PageTableObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageTableObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageTableObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageTableObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) s)) \<longrightarrow> (\<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, capPTMappedASID_CL = 0 && mask 17, capPTMappedAddress_CL = 0 && ~~ mask 20, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) (APIType_capBits object_type.PageTableObject (unat userSizea)) (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)); newType = object_type.PageTableObject; (s, s') \<in> rf_sr; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; 2 ^ APIType_capBits object_type.PageTableObject (unat userSizea) \<le> gsMaxObjectSize s; caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} s; invs' s; pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) s; region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) s'; \<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) 0\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and (\<lambda>a. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) s)) \<longrightarrow> (\<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, capPTMappedASID_CL = 0 && mask 17, capPTMappedAddress_CL = 0 && ~~ mask 20, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) (APIType_capBits object_type.PageTableObject (unat userSizea)) (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)); newType = object_type.PageTableObject; (s, s') \<in> rf_sr; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; 2 ^ APIType_capBits object_type.PageTableObject (unat userSizea) \<le> gsMaxObjectSize s; caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} s; invs' s; pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) s; region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) s'; \<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) 0\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 10 and (\<lambda>s. 1024 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+1024}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 10 10 (Suc 0) \<and> {regionBase..+1024} \<inter> kernel_data_refs = {}) and (\<lambda>a. True)) s
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) (APIType_capBits object_type.PageTableObject (unat userSizea)) (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)); newType = object_type.PageTableObject; (s, s') \<in> rf_sr; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; 2 ^ APIType_capBits object_type.PageTableObject (unat userSizea) \<le> gsMaxObjectSize s; caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} s; invs' s; pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) s; region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) s'; \<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) 0\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) s)) \<longrightarrow> (\<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, capPTMappedASID_CL = 0 && mask 17, capPTMappedAddress_CL = 0 && ~~ mask 20, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v))}}
 3. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) (APIType_capBits object_type.PageTableObject (unat userSizea)) (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)); newType = object_type.PageTableObject; (s, s') \<in> rf_sr; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; 2 ^ APIType_capBits object_type.PageTableObject (unat userSizea) \<le> gsMaxObjectSize s; caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} s; invs' s; pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) s; region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) s'; \<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) 0\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 1024 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 1024 regionBase = replicate 1024 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (pt_Ptr regionBase)))) s)) \<longrightarrow> (\<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1, capPTMappedASID_CL = 0 && mask 17, capPTMappedAddress_CL = 0 && ~~ mask 20, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v))}}
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) (APIType_capBits object_type.PageTableObject (unat userSizea)) (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageTableObject; is_aligned regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)); newType = object_type.PageTableObject; (s, s') \<in> rf_sr; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; 2 ^ APIType_capBits object_type.PageTableObject (unat userSizea) \<le> gsMaxObjectSize s; caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)} s; invs' s; pspace_no_overlap' regionBase (APIType_capBits object_type.PageTableObject (unat userSizea)) s; region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) s'; \<not> to_bool deviceMemorya \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits object_type.PageTableObject (unat userSizea)) 0\<rbrakk> \<Longrightarrow> region_actually_is_bytes regionBase 1024 s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) 1024 regionBase = replicate 1024 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (pt_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> (\<forall>v. cap_page_table_cap_lift v = \<lparr>capPTIsMapped_CL = SCAST(32 signed \<rightarrow> 32) false, capPTMappedASID_CL = 0, capPTMappedAddress_CL = 0, capPTBasePtr_CL = regionBase && ~~ mask 10\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap regionBase None)) v))
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+1024} \<inter> kernel_data_refs = {}; range_cover regionBase 10 10 (Suc 0); is_aligned regionBase 10; newType = object_type.PageTableObject; (s, s') \<in> rf_sr; userSize = unat userSizea; 1024 \<le> gsMaxObjectSize s; caps_overlap_reserved' {regionBase..+1024} s; invs' s; pspace_no_overlap' regionBase 10 s; region_actually_is_bytes regionBase 1024 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 1024 regionBase \<noteq> replicate 1024 0; isFrameType object_type.PageTableObject; deviceMemory; to_bool deviceMemorya\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)} \<inter> \<lbrace>object_type_from_H object_type.PageDirectoryObject = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = deviceMemory\<rbrace>) [] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Call Arch_createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32563 deviceMemorya userSizea regionBasea t) (?Q'32563 deviceMemorya userSizea regionBasea t) [SKIP] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SmallPageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_LargePageObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_SuperSectionObject THEN
  IF deviceMemorya \<noteq> 0 THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
ELSE
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))
FI;;
Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidHighBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidHighBits <s 0x20\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s asidInvalid\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) asidInvalid && (1 << unat Kernel_C.asidLowBits) - 1),SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemorya \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) (SCAST(32 signed \<rightarrow> 32) (asidInvalid >> unat Kernel_C.asidLowBits) && (1 << unat Kernel_C.asidHighBits) - 1),UCAST(32 \<rightarrow> 32) (ptr_val regionBasea)))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,ptr_val regionBasea + SCAST(32 signed \<rightarrow> 32) (1 << unat (0xC + 2)) - SCAST(32 signed \<rightarrow> 32) 1,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q32563 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'32563 deviceMemorya userSizea regionBasea t proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 5\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32563 deviceMemorya userSizea regionBasea 5) (?Q'32563 deviceMemorya userSizea regionBasea 5) [SKIP] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSmallPage (ptr_val regionBasea) (unat ARMSmallPageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 16 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMLargePage (ptr_val regionBasea) (unat ARMLargePageBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 256 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSection (ptr_val regionBasea) (unat ARMSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Cond (if deviceMemorya \<noteq> 0 then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_device_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits))) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyps 4096 (PTR_COERCE(unit \<rightarrow> user_data_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_frames Wellformed_C.ARMSuperSection (ptr_val regionBasea) (unat ARMSuperSectionBits)));;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError UNIV (Guard ShiftError (if 0 \<le>s asidInvalid then UNIV else {}) (Guard ShiftError UNIV (Guard ShiftError UNIV (\<acute>ret__struct_cap_C :== CALL cap_frame_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,SCAST(32 signed \<rightarrow> 32) asidInvalid && 0x3FF,SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite,0,if deviceMemorya \<noteq> 0 then 1 else 0,SCAST(32 signed \<rightarrow> 32) (asidInvalid >> 10) && 0x7F,ptr_val regionBasea))))))));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond {} (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pte_C[256]) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_page_table_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond UNIV (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,SCAST(32 signed \<rightarrow> 32) asidInvalid,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q32563 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'32563 deviceMemorya userSizea regionBasea t proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 5\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32563 deviceMemorya userSizea regionBasea 5) (?Q'32563 deviceMemorya userSizea regionBasea 5) [SKIP] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q32563 deviceMemorya userSizea regionBasea t s \<and> s' \<in> ?Q'32563 deviceMemorya userSizea regionBasea t proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 5\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32563 deviceMemorya userSizea regionBasea 5) (?G'32635 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q32563 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'32634 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'32635 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'32634 deviceMemorya userSizea regionBasea 5 proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea regionBasea t rv'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; t = 5\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32563 deviceMemorya userSizea regionBasea 5) (?G'32635 deviceMemorya userSizea regionBasea rv') [SKIP] (Arch.createObject object_type.PageDirectoryObject regionBase userSize deviceMemory) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> pde_C[4096]) regionBasea))));;
(CALL copyGlobalMappings_'proc(PTR_COERCE(unit \<rightarrow> pde_C) regionBasea);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(regionBasea);;
(CALL cleanCacheRange_PoU_'proc(ptr_val regionBasea,0x3FFF + ptr_val regionBasea,\<acute>ret__unsigned_long);;
(\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,ptr_val regionBasea);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q32563 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'32634 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'32635 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'32634 deviceMemorya userSizea regionBasea 5 proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32563 deviceMemorya userSizea (PTR(unit) regionBase) 5) (?G'32635 deviceMemorya userSizea (PTR(unit) regionBase) ()) [SKIP] (do y <- placeNewObject regionBase makeObject 12;
y <- copyGlobalMappings regionBase;
y <- doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase));
return (arch_capability.PageDirectoryCap regionBase None)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase))));;
(CALL copyGlobalMappings_'proc(pde_Ptr regionBase);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) regionBase);;
(CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,\<acute>ret__unsigned_long);;
(\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))))
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q32563 deviceMemorya userSizea regionBasea t s \<and> s' \<in> {s. s \<in> ?G'32634 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?G'32635 deviceMemorya userSizea regionBasea () \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?G'32634 deviceMemorya userSizea regionBasea 5 proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32711 deviceMemorya userSizea rv) (?Q'32711 deviceMemorya userSizea rv xfdc) [SKIP] (do y <- copyGlobalMappings regionBase;
y <- doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase));
return (arch_capability.PageDirectoryCap regionBase None)
od) (CALL copyGlobalMappings_'proc(pde_Ptr regionBase);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) regionBase);;
(CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,\<acute>ret__unsigned_long);;
(\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))))
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>?Q32711 deviceMemorya userSizea\<rbrace>
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'32711 deviceMemorya userSizea rv (xfdc s)}
 4. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32759 deviceMemorya userSizea rv xfdca rva) (?Q'32759 deviceMemorya userSizea rv xfdca rva xfdc) [SKIP] (do y <- doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase));
return (arch_capability.PageDirectoryCap regionBase None)
od) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR(unit) regionBase);;
(CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,\<acute>ret__unsigned_long);;
(\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>?Q32759 deviceMemorya userSizea rv xfdc\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'32759 deviceMemorya userSizea rv xfdca rva (xfdc s)}
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 5. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 6. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32759 deviceMemorya userSizea rv xfdca rva) (?G'32809 deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long) [SKIP] (do y <- doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase));
return (arch_capability.PageDirectoryCap regionBase None)
od) (CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long);;
(\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>?Q32759 deviceMemorya userSizea rv xfdc\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'32809 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 5. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 6. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb) (?Q'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc) [SKIP] (return (arch_capability.PageDirectoryCap regionBase None)) (\<acute>ret__struct_cap_C :== CALL cap_page_directory_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) false,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<lbrace>?R32931 deviceMemorya userSizea rv xfdca rva\<rbrace> doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase)) \<lbrace>?Q32927 deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb (xfdc s)}
 4. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and ?R32931 deviceMemorya userSizea rv xfdc a\<rbrace>
 5. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 6. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 7. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 8. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (?Q32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb) (?G'32979 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C) [SKIP] (return (arch_capability.PageDirectoryCap regionBase None)) (return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C))
 2. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<lbrace>?R32931 deviceMemorya userSizea rv xfdca rva\<rbrace> doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase)) \<lbrace>?Q32927 deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = capPDMappedASID_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa))) && mask 17, capPDIsMapped_CL = capPDIsMapped_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa))) && mask 1, capPDBasePtr_CL = capPDBasePtr_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) sa))) && ~~ mask 14\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> ?G'32979 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb (xfdc s) v}}
 4. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and ?R32931 deviceMemorya userSizea rv xfdc a\<rbrace>
 5. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 6. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 7. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 8. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C s f. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> ret__struct_cap_C_' (global_exn_var_'_update f (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C\<rparr>)) = ret__struct_cap_C
 2. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C s f. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> globals (ret__struct_cap_C_'_update f s) = globals s
 3. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 4. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<lbrace>?R32931 deviceMemorya userSizea rv xfdca rva\<rbrace> doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase)) \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = capPDMappedASID_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 17, capPDIsMapped_CL = capPDIsMapped_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 1, capPDBasePtr_CL = capPDBasePtr_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && ~~ mask 14\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v\<rbrace>}}
 6. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and ?R32931 deviceMemorya userSizea rv xfdc a\<rbrace>
 7. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 8. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 9. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 10. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C s f. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> globals (ret__struct_cap_C_'_update f s) = globals s
 2. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 3. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<lbrace>?R32931 deviceMemorya userSizea rv xfdca rva\<rbrace> doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase)) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = capPDMappedASID_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 17, capPDIsMapped_CL = capPDIsMapped_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 1, capPDBasePtr_CL = capPDBasePtr_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && ~~ mask 14\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v\<rbrace>}}
 5. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and ?R32931 deviceMemorya userSizea rv xfdc a\<rbrace>
 6. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 7. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 8. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 9. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long rvb xfdc ret__struct_cap_C. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase; dc rvb xfdc; cap_page_directory_cap_lift ret__struct_cap_C = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase && ~~ mask 14\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 2. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<lbrace>?R32931 deviceMemorya userSizea rv xfdca rva\<rbrace> doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase)) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = capPDMappedASID_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 17, capPDIsMapped_CL = capPDIsMapped_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 1, capPDBasePtr_CL = capPDBasePtr_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && ~~ mask 14\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v\<rbrace>}}
 4. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and ?R32931 deviceMemorya userSizea rv xfdc a\<rbrace>
 5. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 6. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 7. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 8. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdc ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdc; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<lbrace>?R32931 deviceMemorya userSizea rv xfdca rva\<rbrace> doMachineOp (cleanCacheRange_PoU regionBase (regionBase + 2 ^ (12 + pdeBits) - 1) (addrFromPPtr regionBase)) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = capPDMappedASID_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 17, capPDIsMapped_CL = capPDIsMapped_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 1, capPDBasePtr_CL = capPDBasePtr_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && ~~ mask 14\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v\<rbrace>}}
 3. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and ?R32931 deviceMemorya userSizea rv xfdc a\<rbrace>
 4. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 5. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 6. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 7. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca; dc rva xfdcb; ret__unsigned_long = addrFromPPtr regionBase\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea rv xfdca rva xfdcb ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = capPDMappedASID_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 17, capPDIsMapped_CL = capPDIsMapped_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && mask 1, capPDBasePtr_CL = capPDBasePtr_' (capPDBasePtr_'_update (\<lambda>_. regionBase) (capPDIsMapped_'_update (\<lambda>_. 0) (capPDMappedASID_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) s))) && ~~ mask 14\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v\<rbrace>}}
 2. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and (\<lambda>a. True)\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 5. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 6. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea xfdca xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32927 deviceMemorya userSizea () xfdca () xfdc (addrFromPPtr regionBase)) CALL cleanCacheRange_PoU_'proc(regionBase,0x3FFF + regionBase,addrFromPPtr regionBase) (if \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v then UNIV else {})
 2. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and (\<lambda>a. True)\<rbrace>
 3. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> ?R'32927 deviceMemorya userSizea rv xfdca rva (xfdc s) v}}
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 5. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 6. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R32763 deviceMemorya userSizea rv\<rbrace> copyGlobalMappings regionBase \<lbrace>\<lambda>a. (\<lambda>s. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize s) and (\<lambda>_. regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) and (\<lambda>a. True)\<rbrace>
 2. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase, \<dots> = rv\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v then UNIV else {})}}}
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and ?R32763 deviceMemorya userSizea a\<rbrace>
 4. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 5. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea rv xfdca. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea rv xfdca) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR(unit) regionBase) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. 0x3FFF + regionBase) (start_'_update (\<lambda>_. regionBase) s)) \<in> \<lbrace>\<acute>start = regionBase\<rbrace> \<inter> \<lbrace>\<acute>end = regionBase + 2 ^ (12 + pdeBits) - 1\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr regionBase\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if \<forall>v. cap_page_directory_cap_lift v = \<lparr>capPDMappedASID_CL = SCAST(32 signed \<rightarrow> 32) false && mask 17, capPDIsMapped_CL = 0, capPDBasePtr_CL = regionBase, \<dots> = rv\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap regionBase None)) v then UNIV else {})}}}
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and (\<lambda>a. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize a \<and> (regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) \<and> True)\<rbrace>
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 4. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea xfdc. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32759 deviceMemorya userSizea () xfdc) CALL copyGlobalMappings_'proc(pde_Ptr regionBase) (if 2 ^ (12 + pdeBits) = 0x4000 then UNIV else {})
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and (\<lambda>a. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize a \<and> (regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) \<and> True)\<rbrace>
 3. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> ?R'32759 deviceMemorya userSizea rv (xfdc s)}
 4. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> placeNewObject regionBase makeObject 12 \<lbrace>\<lambda>a. valid_pde_mappings' and (\<lambda>s. page_directory_at' (armKSGlobalPD (ksArchState s)) s) and page_directory_at' regionBase and (\<lambda>_. is_aligned regionBase pdBits) and (\<lambda>a. unat (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<le> gsMaxObjectSize a \<and> (regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (regionBase + 2 ^ (12 + pdeBits) - 1 - regionBase) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5) \<and> True)\<rbrace>
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if 2 ^ (12 + pdeBits) = 0x4000 then UNIV else {})}}
 3. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<lbrace>?R32718 deviceMemorya userSizea (PTR(unit) regionBase) 5\<rbrace> createObjects' regionBase (Suc 0) (KOArch (KOPDE makeObject)) 12 \<lbrace>\<lambda>a b. valid_pde_mappings' b \<and> page_directory_at' (armKSGlobalPD (ksArchState b)) b \<and> page_directory_at' regionBase b \<and> is_aligned regionBase pdBits \<and> unat (2 ^ (12 + pdeBits) - 1) \<le> gsMaxObjectSize b \<and> regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (2 ^ (12 + pdeBits) - 1) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5\<rbrace>
 2. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if 2 ^ (12 + pdeBits) = 0x4000 then UNIV else {})}}
 3. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and ?R32718 deviceMemorya userSizea regionBasea t) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. newPD_'_update (\<lambda>_. pde_Ptr regionBase) s \<in> UNIV \<inter> \<lbrace>\<acute>newPD = pde_Ptr regionBase\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if 2 ^ (12 + pdeBits) = 0x4000 then UNIV else {})}}
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and (\<lambda>a. (valid_pde_mappings' a \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea regionBasea t) (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea regionBasea t) a \<and> (\<forall>pde. projectKO_opt (KOArch (KOPDE makeObject)) = Some pde \<longrightarrow> pde = ARM_H.InvalidPDE)) \<and> (Suc 0 \<noteq> 0 \<and> range_cover regionBase pdBits (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' regionBase pdBits a \<and> page_directory_at' (armKSGlobalPD (ksArchState a)) a) \<and> ((\<lambda>y. range_cover regionBase (?sz33141 deviceMemorya userSizea regionBasea t) 14 (Suc 0)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea regionBasea t)) a \<and> is_aligned regionBase pdBits \<and> unat (2 ^ (12 + pdeBits) - 1) \<le> gsMaxObjectSize a \<and> regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (2 ^ (12 + pdeBits) - 1) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemorya userSizea. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); to_bool deviceMemorya \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase 14; newType = object_type.PageDirectoryObject; deviceMemory = to_bool deviceMemorya; userSize = unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'32712 deviceMemorya userSizea (PTR(unit) regionBase) ()) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) (if 2 ^ (12 + pdeBits) = 0x4000 then UNIV else {})
 2. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and (\<lambda>a. (valid_pde_mappings' a \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea regionBasea t) (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea regionBasea t) a \<and> (\<forall>pde. projectKO_opt (KOArch (KOPDE makeObject)) = Some pde \<longrightarrow> pde = ARM_H.InvalidPDE)) \<and> (Suc 0 \<noteq> 0 \<and> range_cover regionBase pdBits (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' regionBase pdBits a \<and> page_directory_at' (armKSGlobalPD (ksArchState a)) a) \<and> ((\<lambda>y. range_cover regionBase (?sz33141 deviceMemorya userSizea regionBasea t) 14 (Suc 0)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea regionBasea t)) a \<and> is_aligned regionBase pdBits \<and> unat (2 ^ (12 + pdeBits) - 1) \<le> gsMaxObjectSize a \<and> regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (2 ^ (12 + pdeBits) - 1) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> ?R'32716 deviceMemorya userSizea regionBasea t}
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea regionBasea. ?R'32716 deviceMemorya userSizea regionBasea 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea regionBasea. ?R'32712 deviceMemorya userSizea regionBasea () proof (prove)
goal (1 subgoal):
 1. \<And>deviceMemorya userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits object_type.PageDirectoryObject userSize) (APIType_capBits object_type.PageDirectoryObject userSize) (Suc 0); deviceMemory \<longrightarrow> isFrameType object_type.PageDirectoryObject; is_aligned regionBase (APIType_capBits object_type.PageDirectoryObject userSize); newType = object_type.PageDirectoryObject; to_bool deviceMemorya = deviceMemory; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H object_type.PageDirectoryObject = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits object_type.PageDirectoryObject userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits object_type.PageDirectoryObject userSize} and (\<lambda>s. 2 ^ APIType_capBits object_type.PageDirectoryObject userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) s \<and> (\<not> deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) regionBase = replicate (2 ^ APIType_capBits object_type.PageDirectoryObject userSize) 0)}\<rbrakk> \<Longrightarrow> (valid_global_refs' and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 14 and (\<lambda>s. 16384 \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+16384}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase 14 14 (Suc 0) \<and> {regionBase..+16384} \<inter> kernel_data_refs = {}) and (\<lambda>a. (valid_pde_mappings' a \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea regionBasea t) (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea regionBasea t) a \<and> (\<forall>pde. projectKO_opt (KOArch (KOPDE makeObject)) = Some pde \<longrightarrow> pde = ARM_H.InvalidPDE)) \<and> (Suc 0 \<noteq> 0 \<and> range_cover regionBase pdBits (objBitsKO (KOArch (KOPDE makeObject)) + 12) (Suc 0) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' regionBase pdBits a \<and> page_directory_at' (armKSGlobalPD (ksArchState a)) a) \<and> ((\<lambda>y. range_cover regionBase (?sz33141 deviceMemorya userSizea regionBasea t) 14 (Suc 0)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea regionBasea t)) a \<and> is_aligned regionBase pdBits \<and> unat (2 ^ (12 + pdeBits) - 1) \<le> gsMaxObjectSize a \<and> regionBase \<le> regionBase + 2 ^ (12 + pdeBits) - 1 \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + (2 ^ (12 + pdeBits) - 1) \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase 16384 s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) 16384 regionBase = replicate 16384 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (pd_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> globals_update (t_hrs_'_update (hrs_htd_update (ptr_retyp (pd_Ptr regionBase)))) s \<in> (if 2 ^ (12 + pdeBits) = 0x4000 then UNIV else {})}}
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5 proof (prove)
goal (1 subgoal):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s \<and> valid_pde_mappings' s \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> range_cover regionBase (?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> regionBase \<le> 0x3FFF + regionBase \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5 proof (prove)
goal (1 subgoal):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s \<and> valid_pde_mappings' s \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> range_cover regionBase (?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> regionBase \<le> 0x3FFF + regionBase \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5 proof (prove)
goal (1 subgoal):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s \<and> valid_pde_mappings' s \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> range_cover regionBase (?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> regionBase \<le> 0x3FFF + regionBase \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5 proof (prove)
goal (1 subgoal):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s \<and> valid_pde_mappings' s \<and> range_cover regionBase (?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> page_directory_at' (armKSGlobalPD (ksArchState s)) s \<and> range_cover regionBase (?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) 14 (Suc 0) \<and> pspace_no_overlap' regionBase (?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) (SCAST(32 signed \<rightarrow> 32) seL4_ARM_PageDirectoryObject)) s \<and> regionBase \<le> 0x3FFF + regionBase \<and> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF \<and> regionBase && mask 5 = addrFromPPtr regionBase && mask 5
flex-flex pairs:
\<lambda>deviceMemorya userSizea. ?sz33141 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33140 deviceMemorya userSizea (PTR(unit) regionBase) 5
\<lambda>deviceMemorya userSizea. ?sz33124 deviceMemorya userSizea (PTR(unit) regionBase) 5 \<equiv>\<^sup>? \<lambda>deviceMemorya userSizea. ?sz33123 deviceMemorya userSizea (PTR(unit) regionBase) 5 proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s
 2. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> valid_pde_mappings' s
 3. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s)) s
 4. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase \<le> 0x3FFF + regionBase
 5. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF
 6. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase && mask 5 = addrFromPPtr regionBase && mask 5 proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> valid_pde_mappings' s
 2. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s)) s
 3. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase \<le> 0x3FFF + regionBase
 4. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF
 5. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase && mask 5 = addrFromPPtr regionBase && mask 5 proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s)) s
 2. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase \<le> 0x3FFF + regionBase
 3. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF
 4. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase && mask 5 = addrFromPPtr regionBase && mask 5 proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase \<le> 0x3FFF + regionBase
 2. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> addrFromPPtr regionBase \<le> addrFromPPtr regionBase + 0x3FFF
 3. \<And>deviceMemorya userSizea s s'. \<lbrakk>regionBase \<noteq> 0; {regionBase..+16384} \<inter> kernel_data_refs = {}; range_cover regionBase 14 14 (Suc 0); \<not> deviceMemory; newType = object_type.PageDirectoryObject; \<not> to_bool deviceMemorya; (s, s') \<in> rf_sr; userSize = unat userSizea; invs' s; region_actually_is_bytes regionBase 16384 s'; heap_list (hrs_mem (t_hrs_' (globals s'))) 16384 regionBase = replicate 16384 0; pspace_no_overlap' regionBase 14 s; caps_overlap_reserved' {regionBase..+16384} s; 16384 \<le> gsMaxObjectSize s; valid_arch_state' s; is_aligned regionBase 14; is_aligned (addrFromPPtr regionBase) 14\<rbrakk> \<Longrightarrow> regionBase && mask 5 = addrFromPPtr regionBase && mask 5 proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (\<lambda>a. ccap_relation (capability.ArchObjectCap a)) ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize deviceMemory) (createObject_c_preconds regionBase newType userSize deviceMemory) [] (Arch.createObject newType regionBase userSize deviceMemory) (Call Arch_createObject_'proc)

goal:
No subgoals!