def sys_dup(old, oldfd, pid, newfd):
cond = z3.And(
is_pid_valid(pid),
# the pid is either current or an embryo belonging to current
z3.Or(pid == old.current,
z3.And(
old.procs[pid].ppid == old.current,
old.procs[pid].state == dt.proc_state.PROC_EMBRYO)),
is_fd_valid(oldfd),
is_fn_valid(old.procs[old.current].ofile(oldfd)),
is_fd_valid(newfd),
z3.Not(is_fn_valid(old.procs[pid].ofile(newfd))),
)
new = old.copy()
fn = new.procs[old.current].ofile(oldfd)
new.procs[pid].ofile[newfd] = fn
new.procs[pid].nr_fds[newfd] += 1
# bump file refcnt
new.files[fn].refcnt[(pid, newfd)] += 1
return cond, util.If(cond, new, old)
def sys_map_pcipage(old, pt, index, pcipn, perm):
cond = z3.And(
# pt is a valid PT page
is_pn_valid(pt),
old.pages[pt].type == dt.page_type.PAGE_TYPE_X86_PT,
old.pages[pt].owner == old.current,
z3.ULT(index, 512),
# pcipn is a valid pci page owned by current
is_pcipn_valid(pcipn),
old.pcipages[pcipn].valid,
old.pci[old.pcipages[pcipn].owner].owner == old.current,
# perm has no unsafe bits on it and it is present
perm & (dt.MAX_INT64 ^ dt.PTE_PERM_MASK) == 0,
perm & dt.PTE_P != 0,
# slot should be empty
old.pages[pt].data(index) & dt.PTE_P == 0,
)
new = old.copy()
new.pages[pt].data[index] = ((z3.UDiv(
dt.PCI_START, util.i64(dt.PAGE_SIZE)) + pcipn) << dt.PTE_PFN_SHIFT) | perm
# maintain the "shadow" pgtable
new.pages[pt].pgtable_pn[index] = pcipn
new.pages[pt].pgtable_perm[index] = perm
new.pages[pt].pgtable_type[index] = dt.PGTYPE_PCIPAGE
new.flush_tlb(old.current)
return cond, util.If(cond, new, old)
def sys_reap(old, pid):
cond = z3.And(
is_pid_valid(pid),
# Only the owner can reap a child
old.procs[pid].ppid == old.current,
# The pid to reap is a zombie
old.procs[pid].state == dt.proc_state.PROC_ZOMBIE,
# The proc has no children/open fds/pages/devices/ports
old.procs[pid].nr_devs() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_children() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_fds() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_pages() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_dmapages() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_ports() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_vectors() == z3.BitVecVal(0, dt.size_t),
old.procs[pid].nr_intremaps() == z3.BitVecVal(0, dt.size_t),
)
new = old.copy()
new.procs[old.current].nr_children[pid] -= 1
new.procs[pid].state = dt.proc_state.PROC_UNUSED
new.procs[pid].ppid = z3.BitVecVal(0, dt.pid_t)
new.procs[pid].page_table_root = z3.BitVecVal(0, dt.pn_t)
new.procs[pid].stack = z3.BitVecVal(0, dt.pn_t)
new.procs[pid].killed = z3.BoolVal(False)
new.procs[pid].hvm = z3.BitVecVal(0, dt.pn_t)
new.procs[pid].use_io_bitmap = z3.BoolVal(False)
new.procs[pid].io_bitmap_a = z3.BitVecVal(0, dt.pn_t)
new.procs[pid].io_bitmap_b = z3.BitVecVal(0, dt.pn_t)
return cond, util.If(cond, new, old)
def sys_create(old, fd, fn, type, value, omode):
cond = z3.And(
type != dt.file_type.FD_NONE,
# fd is valid and empty
is_fd_valid(fd),
z3.Not(is_fn_valid(old.procs[old.current].ofile(fd))),
# fn is valid and unused
is_fn_valid(fn),
old.files[fn].refcnt() == 0,
)
new = old.copy()
new.files[fn].type = type
new.files[fn].value = value
new.files[fn].omode = omode
new.files[fn].offset = z3.BitVecVal(0, dt.off_t)
new.procs[old.current].ofile[fd] = fn
new.procs[old.current].nr_fds[fd] += 1
# bump file refcnt
new.files[fn].refcnt[(old.current, fd)] += 1
return cond, util.If(cond, new, old)
def sys_recv(old, pid, pn, fd):
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].state == dt.proc_state.PROC_RUNNABLE,
is_pn_valid(pn),
old.pages[pn].owner == old.current,
old.pages[pn].type == dt.page_type.PAGE_TYPE_FRAME,
z3.Implies(is_fd_valid(fd),
z3.Not(is_fn_valid(old.procs[old.current].ofile(fd))))
)
new = old.copy()
new.procs[old.current].ipc_from = z3.BitVecVal(0, dt.pid_t)
new.procs[old.current].ipc_page = pn
new.procs[old.current].ipc_size = z3.BitVecVal(0, dt.size_t)
new.procs[old.current].ipc_fd = fd
new.procs[old.current].state = dt.proc_state.PROC_SLEEPING
new.procs[pid].state = dt.proc_state.PROC_RUNNING
new.current = pid
return cond, util.If(cond, new, old)
def get_iommu_sub_type(type):
return util.If(
type == dt.page_type.PAGE_TYPE_IOMMU_PML4,
dt.page_type.PAGE_TYPE_IOMMU_PDPT,
util.If(
type == dt.page_type.PAGE_TYPE_IOMMU_PDPT,
dt.page_type.PAGE_TYPE_IOMMU_PD,
util.If(
type == dt.page_type.PAGE_TYPE_IOMMU_PD,
dt.page_type.PAGE_TYPE_IOMMU_PT,
util.If(
type == dt.page_type.PAGE_TYPE_IOMMU_PT,
dt.page_type.PAGE_TYPE_IOMMU_FRAME,
util.FreshBitVec(
'invalid',
dt.page_type.PAGE_TYPE_IOMMU_FRAME.size())))))
def sys_alloc_iommu_frame(old, frm, index, to, perm):
cond = z3.And(
# to page is valid and free
is_dmapn_valid(to),
old.dmapages[to].type == dt.page_type.PAGE_TYPE_FREE,
# from page is a valid page with correct type
is_pn_valid(frm),
old.pages[frm].type == dt.page_type.PAGE_TYPE_IOMMU_PT,
old.pages[frm].owner == old.current,
# index is a valid page index
z3.ULT(index, 512),
# permission bits check
perm & (dt.MAX_INT64 ^ (dt.DMAR_PTE_R | dt.DMAR_PTE_W)) == 0,
old.pages[frm].data(index) == 0,
)
new = old.copy()
new.pages[frm].data[index] = (new.dmapages_ptr_to_int + to * dt.PAGE_SIZE) | perm
new.pages[frm].pgtable_pn[index] = to
new.pages[frm].pgtable_perm[index] = perm
new.dmapages[to].type = dt.page_type.PAGE_TYPE_IOMMU_FRAME
new.dmapages[to].owner = new.current
new.procs[new.current].nr_dmapages[to] += 1
new.flush_iotlb()
return cond, util.If(cond, new, old)
def sys_send(old, pid, val, pn, size, fd):
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].state == dt.proc_state.PROC_SLEEPING,
is_pn_valid(pn),
old.pages[pn].owner == old.current,
z3.ULE(size, dt.PAGE_SIZE),
z3.Implies(is_fd_valid(fd),
is_fn_valid(old.procs[old.current].ofile(fd))),
)
new = old.copy()
new.procs[pid].ipc_from = old.current
new.procs[pid].ipc_val = val
new.procs[pid].ipc_size = size
# memcpy
new.pages.data = lambda pn0, idx0, oldfn: \
util.If(z3.And(pn0 == old.procs[pid].ipc_page, z3.ULT(idx0, size)),
oldfn(pn, idx0),
oldfn(pn0, idx0))
########
new2 = new.copy()
cond2 = z3.And(is_fd_valid(fd), is_fd_valid(new2.procs[pid].ipc_fd))
fn = old.procs[old.current].ofile(fd)
fd = old.procs[pid].ipc_fd
new2.procs[pid].ofile[fd] = fn
# bump proc nr_fds
new2.procs[pid].nr_fds[fd] += 1
# bump file refcnt
new2.files[fn].refcnt[(pid, fd)] += 1
new3 = util.If(cond2, new2, new)
new3.procs[pid].state = dt.proc_state.PROC_RUNNING
new3.procs[old.current].state = dt.proc_state.PROC_RUNNABLE
new3.current = pid
return cond, util.If(cond, new3, old)
def kk_wait(old,pid,w_len):
cond = z3.And(
is_pid_valid(pid),
)
new = old.copy()
new.esbs[pid].primitive=dt.K5_WAIT
new.esbs[pid].dst_port=old.current
return cond,util.If(cond,new,old)
def sys_call(old, pid, val, inpn, size, outpn, outfd):
cond, new = send_recv(old, pid, val, inpn, size,
z3.BitVecVal(-1, dt.fd_t), outpn, outfd)
new.procs[old.current].ipc_from = pid
new.current = pid
return cond, util.If(cond, new, old)
def sys_reply_wait(old, pid, val, inpn, size, infd, outpn):
cond, new = send_recv(old, pid, val, inpn, size, infd,
outpn, z3.BitVecVal(-1, dt.fd_t))
new.procs[old.current].ipc_from = z3.BitVecVal(0, dt.pid_t)
new.current = pid
return cond, util.If(cond, new, old)
def sys_switch(old, pid):
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].state == dt.proc_state.PROC_RUNNABLE,
# This is implied by pid having state runnable,
# current is always running
old.current != pid,
)
new = old.copy()
new.procs[old.current].state = util.If(
old.procs[old.current].killed, dt.proc_state.PROC_ZOMBIE, dt.proc_state.PROC_RUNNABLE)
new.procs[pid].state = dt.proc_state.PROC_RUNNING
new.current = pid
return cond, util.If(cond, new, old)
def alloc_page_table(old, pid, frm, index, to, perm, from_type, to_type):
cond = z3.And(
# The to argument is a valid page and is marked as free
is_pn_valid(to),
old.pages[to].type == dt.page_type.PAGE_TYPE_FREE,
# The pid is valid and is either current running process or child embryo
is_pid_valid(pid),
z3.Or(pid == old.current,
z3.And(
old.procs[pid].ppid == old.current,
old.procs[pid].state == dt.proc_state.PROC_EMBRYO)),
# The from parameter is valid and of type PML4 and owned by pid
is_pn_valid(frm),
old.pages[frm].owner == pid,
old.pages[frm].type == from_type,
# Index is a valid page index
z3.ULT(index, 512),
# perm has no unsafe bits on it and it is present
perm & (dt.MAX_INT64 ^ dt.PTE_PERM_MASK) == 0,
perm & dt.PTE_P != 0,
# index does not have the P bit in PML4
old.pages[frm].data(index) & dt.PTE_P == 0,
)
new = old.copy()
new.pages[to].owner = pid
new.pages[to].type = to_type
new.pages[frm].data[index] = (
(z3.UDiv(new.pages_ptr_to_int, util.i64(dt.PAGE_SIZE)) + to) << dt.PTE_PFN_SHIFT) | perm
# Zero out the new page
new.pages[to].data = util.i64(0)
# Maintain the "shadow" pgtable
new.pages[frm].pgtable_pn[index] = to
new.pages[to].pgtable_reverse_pn = frm
new.pages[to].pgtable_reverse_idx = index
new.pages[frm].pgtable_perm[index] = perm
new.pages[frm].pgtable_type[index] = dt.PGTYPE_PAGE
new.pages[to].pgtable_pn = util.i64(0)
new.pages[to].pgtable_perm = util.i64(0)
new.pages[to].pgtable_type = dt.PGTYPE_NONE
new.procs[pid].nr_pages[to] += 1
new.flush_tlb(pid)
return cond, util.If(cond, new, old)
def sys_set_runnable(old, pid):
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].ppid == old.current,
old.procs[pid].state == dt.proc_state.PROC_EMBRYO)
new = old.copy()
new.procs[pid].state = dt.proc_state.PROC_RUNNABLE
return cond, util.If(cond, new, old)
def mmap_impl(old, current, va, perm):
new = old
idx1, idx2, idx3, idx4 = va
# Pick a few pages -- we don't care how they are picked.
pml4 = old.procs[current].page_table_root
pdptpn = util.FreshBitVec('pdptpn', kdt.pn_t)
pdpn = util.FreshBitVec('pdpn', kdt.pn_t)
ptpn = util.FreshBitVec('ptpn', kdt.pn_t)
framepn = util.FreshBitVec('framepn', kdt.pn_t)
condpdpt, new = kspec.sys_alloc_pdpt(new, current, pml4, idx1, pdptpn,
perm)
condpdpt = z3.Or(
condpdpt,
z3.And(
z3.ULT(idx1, 512),
new.pages[pml4].pgtable_pn(idx1) == pdptpn,
(new.pages[pml4].data(idx1) & kdt.PTE_P) != z3.BitVecVal(
0, kdt.size_t),
new.pages[pml4].pgtable_perm(idx1) == perm,
# The above implies this
# new.pages[pml4].data(idx1) == (((z3.UDiv(new.pages_ptr_to_int, util.i64(4096)) + pdptpn) << kdt.PTE_PFN_SHIFT) | perm),
))
condpd, new = kspec.sys_alloc_pd(new, current, pdptpn, idx2, pdpn, perm)
condpd = z3.Or(
condpd,
z3.And(
z3.ULT(idx2, 512),
new.pages[pdptpn].pgtable_pn(idx2) == pdpn,
(new.pages[pdptpn].data(idx2) & kdt.PTE_P) != z3.BitVecVal(
0, kdt.size_t),
new.pages[pdptpn].pgtable_perm(idx2) == perm,
))
condpt, new = kspec.sys_alloc_pt(new, current, pdpn, idx3, ptpn, perm)
condpt = z3.Or(
condpt,
z3.And(
z3.ULT(idx3, 512),
new.pages[pdpn].pgtable_pn(idx3) == ptpn,
(new.pages[pdpn].data(idx3) & kdt.PTE_P) != z3.BitVecVal(
0, kdt.size_t),
new.pages[pdpn].pgtable_perm(idx3) == perm,
))
condframe, new = kspec.sys_alloc_frame(new, current, ptpn, idx4, framepn,
perm)
cond = z3.And(condpdpt, condpd, condpt, condframe)
return cond, util.If(cond, new, old)
def extintr(old, vector):
pid = old.vectors[vector].owner
cond = is_pid_valid(pid)
cond2 = z3.And(cond, old.procs[pid].state == dt.proc_state.PROC_SLEEPING)
vector = z3.ZeroExt(64 - vector.size(), vector)
idx = z3.UDiv(vector, 64)
mask = 1 << (vector % 64)
new = old.copy()
new.procs[pid].intr[idx] = new.procs[pid].intr(idx) | mask
new2 = new.copy()
new2.procs[pid].state = dt.proc_state.PROC_RUNNABLE
new2.procs[pid].ipc_from = z3.BitVecVal(0, dt.pid_t)
new2.procs[pid].ipc_val = vector
new2.procs[pid].ipc_size = z3.BitVecVal(0, dt.size_t)
return cond, util.If(cond, util.If(cond2, new2, new), old)
def sys_dup2(old, oldfd, pid, newfd):
cond = z3.And(
is_pid_valid(pid),
# the pid is either current or an embryo belonging to current
z3.Or(pid == old.current,
z3.And(
old.procs[pid].ppid == old.current,
old.procs[pid].state == dt.proc_state.PROC_EMBRYO)),
is_fd_valid(oldfd),
is_fn_valid(old.procs[old.current].ofile(oldfd)),
is_fd_valid(newfd),
)
new1 = old.copy()
newfn = new1.procs[pid].ofile(newfd)
# If fn != 0
new1.procs[pid].ofile[newfd] = z3.BitVecVal(0, dt.fn_t)
new1.procs[pid].nr_fds[newfd] -= 1
# decrement file refcnt
new1.files[newfn].refcnt[(pid, newfd)] -= 1
ref = new1.files[newfn].refcnt()
# If the refcnt is zero, clear the file slot
new1.files[newfn].type = util.If(ref == 0, dt.file_type.FD_NONE, new1.files[newfn].type)
new1.files[newfn].value = util.If(ref == 0, z3.BitVecVal(0, dt.uint64_t), new1.files[newfn].value)
new1.files[newfn].offset = util.If(ref == 0, z3.BitVecVal(0, dt.off_t), new1.files[newfn].offset)
new1.files[newfn].omode = util.If(ref == 0, z3.BitVecVal(0, dt.uint64_t), new1.files[newfn].omode)
new2 = util.If(is_fn_valid(old.procs[pid].ofile(newfd)), new1, old.copy())
# un-conditional
fn = new2.procs[old.current].ofile(oldfd)
new2.procs[pid].ofile[newfd] = fn
new2.procs[pid].nr_fds[newfd] += 1
# bump file refcnt
new2.files[fn].refcnt[(pid, newfd)] += 1
# posix: if fds are the same, do nothing
new3 = util.If(z3.And(old.current == pid, oldfd == newfd),
old.copy(), new2)
return cond, util.If(cond, new3, old)
def kk_reply(old,pid,ack_err,s_len):
cond = z3.And(
is_pid_valid(pid),
)
new = old.copy()
new.esbs[pid].primitive=dt.K5_REPLY
new.esbs[pid].src_port=old.current
new.esbs[pid].dst_port=pid
#new.esbs[pid].head
return cond,util.If(cond,new,old)
def kk_call(old,pid,service,c_len):
cond = z3.And(
is_pid_valid(pid),
is_service_valid(service),
)
new = old.copy()
#new.esbs[pid].primitive=dt.K5_CALL
new.esbs[pid].src_port=old.to.src_port
new.esbs[pid].dst_port=old.to.dst_port
return cond,util.If(cond,new,old)
def sys_alloc_vector(old, vector):
cond = z3.And(
old.vectors[vector].owner == 0
)
new = old.copy()
new.vectors[vector].owner = old.current
new.procs[old.current].nr_vectors[vector] += 1
return cond, util.If(cond, new, old)
def newf(*args):
assert len(args) == len(dst_end_args)
cond = []
for a, b in zip(args[:-1], dst_start_args[:-1]):
cond.append(a == b)
cond.append(z3.UGE(args[-1], dst_start_args[-1]))
cond.append(z3.ULE(args[-1], dst_end_args[-1]))
cond = z3.And(*cond)
return util.If(cond, z3.BitVecVal(0, write_size), dstfn(*args))
def sys_reclaim_port(old, port):
pid = old.io[port].owner
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].state == dt.proc_state.PROC_ZOMBIE
)
new = old.copy()
new.procs[pid].nr_ports[port] -= 1
new.io[port].owner = z3.BitVecVal(0, dt.pid_t)
return cond, util.If(cond, new, old)
def pgentry2pfn(ks, off, perm, type):
res = util.i64(0)
res = util.If(type == dt.PGTYPE_PCIPAGE, util.i64(dt.PCI_START), res)
res = util.If(type == dt.PGTYPE_IOMMU_FRAME, ks.dmapages_ptr_to_int, res)
res = util.If(type == dt.PGTYPE_DEVICES, ks.devices_ptr_to_int, res)
res = util.If(type == dt.PGTYPE_FILE_TABLE, ks.file_table_ptr_to_int, res)
res = util.If(type == dt.PGTYPE_PAGE_DESC, ks.page_desc_table_ptr_to_int,
res)
res = util.If(type == dt.PGTYPE_PROC, ks.proc_table_ptr_to_int, res)
res = util.If(type == dt.PGTYPE_PAGE, ks.pages_ptr_to_int, res)
return ((z3.UDiv(res, util.i64(dt.PAGE_SIZE)) + off) <<
dt.PTE_PFN_SHIFT) | perm
def newf(*args):
assert len(args) == len(dst_end_args)
cond = []
for a, b in zip(args[:-1], dst_start_args[:-1]):
cond.append(a == b)
cond.append(z3.UGE(args[-1], dst_start_args[-1]))
cond.append(z3.ULT(args[-1], dst_end_args[-1]))
cond = z3.And(*cond)
srcargs = src_start_args[:-1] + [args[-1]]
return util.If(cond, srcfn(*srcargs), dstfn(*args))
def sys_lseek(old, fd, offset):
cond = z3.And(
is_fd_valid(fd),
is_fn_valid(old.procs[old.current].ofile(fd)),
old.files[old.procs[old.current].ofile(fd)].type == dt.file_type.FD_INODE,
offset >= 0,
)
new = old.copy()
fn = old.procs[old.current].ofile(fd)
new.files[fn].offset = offset
return cond, util.If(cond, new, old)
def sys_alloc_port(old, port):
cond = z3.And(
old.io[port].owner == 0,
old.procs[old.current].use_io_bitmap,
)
new = old.copy()
new.io[port].owner = old.current
new.procs[old.current].nr_ports[port] += 1
page = util.If(z3.ULT(port, 0x8000),
new.procs[new.current].io_bitmap_a,
new.procs[new.current].io_bitmap_b)
port = z3.ZeroExt(64 - port.size(), util.If(z3.ULT(port, 0x8000), port, port - 0x8000))
idx = z3.UDiv(port, 64)
mask = 1 << (port % 64)
new.pages[page].data[idx] = new.pages[page].data(idx) & ~mask
return cond, util.If(cond, new, old)
def sys_reclaim_vector(old, vector):
pid = old.vectors[vector].owner
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].state == dt.proc_state.PROC_ZOMBIE,
old.procs[pid].nr_intremaps() == 0,
)
new = old.copy()
new.vectors[vector].owner = z3.BitVecVal(0, dt.pid_t)
new.procs[pid].nr_vectors[vector] -= 1
return cond, util.If(cond, new, old)
def sys_reclaim_page(old, pn):
cond = z3.And(
is_pn_valid(pn),
old.pages[pn].type != dt.page_type.PAGE_TYPE_FREE,
is_pid_valid(old.pages[pn].owner),
old.procs[old.pages[pn].owner].state == dt.proc_state.PROC_ZOMBIE,
old.procs[old.pages[pn].owner].nr_devs() == z3.BitVecVal(0, dt.size_t),
)
new = old.copy()
new.procs[new.pages[pn].owner].nr_pages[pn] -= 1
new.pages[pn].type = dt.page_type.PAGE_TYPE_FREE
new.pages[pn].owner = z3.BitVecVal(0, dt.pid_t)
return cond, util.If(cond, new, old)
def sys_reclaim_iommu_root(old, devid):
pid = old.pci[devid].owner
cond = z3.And(
is_pid_valid(pid),
old.procs[pid].state == dt.proc_state.PROC_ZOMBIE,
old.procs[pid].nr_intremaps() == 0,
)
new = old.copy()
new.procs[pid].nr_devs[devid] -= 1
# Clear the page_table_root
new.pci[devid].page_table_root = z3.BitVecVal(-1, dt.pn_t)
new.pci[devid].owner = z3.BitVecVal(0, dt.pid_t)
new.flush_iotlb()
return cond, util.If(cond, new, old)
def sys_map_file(old, pid, frm, index, n, perm):
cond = z3.And(
z3.ULT(n, dt.NPAGES_FILE_TABLE),
is_pid_valid(pid),
# the pid is either current or an embryo belonging to current
z3.Or(pid == old.current,
z3.And(
old.procs[pid].ppid == old.current,
old.procs[pid].state == dt.proc_state.PROC_EMBRYO)),
# frm is a valid pn of type PT whose owner is pid
is_pn_valid(frm),
old.pages[frm].type == dt.page_type.PAGE_TYPE_X86_PT,
old.pages[frm].owner == pid,
# Index is a valid page index
z3.ULT(index, 512),
# perm has no unsafe bits on it and it is present and non-writable
perm & (dt.MAX_INT64 ^ dt.PTE_PERM_MASK) == 0,
perm & dt.PTE_P != 0,
perm & dt.PTE_W == 0,
# index does not have the P bit in the from page
old.pages[frm].data(index) & dt.PTE_P == 0,
)
new = old.copy()
new.pages[frm].data[index] = (
(z3.UDiv(new.file_table_ptr_to_int, util.i64(dt.PAGE_SIZE)) + n) << dt.PTE_PFN_SHIFT) | perm
# maintain the "shadow" pgtable
new.pages[frm].pgtable_pn[index] = n
new.pages[frm].pgtable_perm[index] = perm
new.pages[frm].pgtable_type[index] = dt.PGTYPE_FILE_TABLE
new.flush_tlb(pid)
return cond, util.If(cond, new, old)