theory VSpace_R

lemma deleteASIDPool_corres:
  "corres dc
          (invs and K (is_aligned base asid_low_bits
                         \<and> base \<le> mask asid_bits)
           and asid_pool_at ptr)
          (pspace_aligned' and pspace_distinct' and no_0_obj'
               and valid_arch_state' and cur_tcb')
          (delete_asid_pool base ptr) (deleteASIDPool base ptr)" apply (simp add: delete_asid_pool_def deleteASIDPool_def) apply (rule corres_assume_pre, simp add: is_aligned_mask
                                     cong: corres_weak_cong) apply (thin_tac P for P)+ apply (rule corres_guard_imp) apply (rule corres_split[OF corres_gets_asid]) apply (rule corres_when) apply simp apply (simp add: liftM_def) apply (rule corres_split[OF getObject_ASIDPool_corres']) apply (rule corres_split) apply (rule corres_mapM [where r=dc and r'=dc], simp, simp) prefer 5 apply (rule order_refl) apply (drule_tac t="inv f x \<circ> g" for f x g in sym) apply (rule_tac P="invs and
                                 ko_at (ArchObj (arch_kernel_obj.ASIDPool pool)) ptr and
                                 [VSRef (ucast (asid_high_bits_of base)) None] \<rhd> ptr and
                                 K (is_aligned base asid_low_bits
                                      \<and> base \<le> mask asid_bits)"
                         and P'="pspace_aligned' and pspace_distinct' and no_0_obj'"
                              in corres_guard_imp) apply (rule corres_when) apply (clarsimp simp: ucast_ucast_low_bits) apply simp apply (rule_tac pd1="the (pool (ucast xa))"
                          in corres_split[OF flushSpace_corres]) apply (rule_tac pd="the (pool (ucast xa))"
                             in invalidateASIDEntry_corres) apply wp apply clarsimp apply (wpsimp)+ apply (clarsimp simp: invs_def valid_state_def
                                     valid_arch_caps_def valid_pspace_def
                                     vspace_at_asid_def cong: conj_cong) apply (rule conjI) apply (clarsimp simp: mask_def asid_low_bits_word_bits
                               elim!: is_alignedE) apply (subgoal_tac "of_nat q < (2 ^ asid_high_bits :: word32)") apply (subst mult.commute, rule word_add_offset_less) apply assumption apply assumption apply (simp add: asid_bits_def word_bits_def) apply (erule order_less_le_trans) apply (simp add: word_bits_def asid_low_bits_def asid_high_bits_def) apply (simp add: asid_bits_def asid_high_bits_def asid_low_bits_def) apply (drule word_power_less_diff) apply (drule of_nat_mono_maybe[where 'a=32, rotated]) apply (simp add: word_bits_def asid_low_bits_def) apply (subst word_unat_power, simp) apply (simp add: asid_bits_def word_bits_def) apply (simp add: asid_low_bits_def word_bits_def) apply (simp add: asid_bits_def asid_low_bits_def asid_high_bits_def) apply (subst conj_commute, rule context_conjI, simp add: valid_vspace_objs_def) apply (erule vs_lookup_trancl_step) apply (rule r_into_trancl) apply (erule vs_lookup1I) apply (simp add: vs_refs_def) apply (rule image_eqI[rotated]) apply (rule graph_ofI, simp) apply clarsimp apply fastforce apply (simp add: add_mask_eq asid_low_bits_word_bits
                                 ucast_ucast_mask asid_low_bits_def[symmetric]
                                 asid_high_bits_of_def) apply (rule conjI) apply (rule sym) apply (simp add: is_aligned_add_helper[THEN conjunct1]
                                  mask_eq_iff_w2p asid_low_bits_def word_size) apply (rule_tac f="\<lambda>a. a && mask n" for n in arg_cong) apply (rule shiftr_eq_mask_eq) apply (simp add: is_aligned_add_helper is_aligned_neg_mask_eq) apply clarsimp apply (subgoal_tac "base \<le> base + xa") apply (simp add: valid_vs_lookup_def asid_high_bits_of_def) subgoal by (fastforce intro: vs_lookup_pages_vs_lookupI) apply (erule is_aligned_no_wrap') apply (simp add: asid_low_bits_word_bits) apply (simp add: asid_low_bits_word_bits) apply clarsimp apply ((wp|clarsimp simp: o_def)+)[3] apply (rule corres_split) apply (rule corres_modify [where P=\<top> and P'=\<top>]) apply (simp add: state_relation_def arch_state_relation_def) apply (rule ext) apply clarsimp apply (erule notE) apply (rule word_eqI[rule_format]) apply (drule_tac x1="ucast xa" in bang_eq [THEN iffD1]) apply (erule_tac x=n in allE) apply (simp add: word_size nth_ucast) apply (rule corres_split) apply (rule getCurThread_corres) apply (simp only:) apply (rule setVMRoot_corres) apply wp+ apply (rule_tac R="\<lambda>_ s. rv = arm_asid_table (arch_state s)"
                    in hoare_post_add) apply (drule sym, simp only: ) apply (drule sym, simp only: ) apply (thin_tac "P" for P)+ apply (simp only: pred_conj_def cong: conj_cong) apply simp apply (fold cur_tcb_def) apply (strengthen valid_arch_state_unmap_strg
                           valid_vspace_objs_unmap_strg
                           valid_asid_map_unmap
                           valid_vs_lookup_unmap_strg) apply (simp add: valid_global_objs_arch_update) apply (rule hoare_vcg_conj_lift,
                 (rule mapM_invalidate[where ptr=ptr])?,
                 ((wp mapM_wp' | simp)+)[1])+ apply (rule_tac R="\<lambda>_ s. rv' = armKSASIDTable (ksArchState s)"
                     in hoare_post_add) apply (simp only: pred_conj_def cong: conj_cong) apply simp apply (strengthen valid_arch_state_unmap_strg') apply (fold cur_tcb'_def) apply (wp mapM_wp')+ apply (clarsimp simp: cur_tcb'_def) apply (simp add: o_def pred_conj_def) apply wp apply (wp getASID_wp)+ apply (clarsimp simp: conj_comms) apply (auto simp: vs_lookup_def invs_vspace_objs[simplified]
               intro: vs_asid_refsI)[1] apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (invs and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') (delete_asid_pool base ptr) (deleteASIDPool base ptr) proof (prove)
goal (1 subgoal):
 1. corres dc (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') (do y <- assert (base && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
when (asid_table (asid_high_bits_of base) = Some ptr) (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od)
od) (do y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
when (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>invs s \<and> base && mask local.asid_low_bits = 0 \<and> base \<le> mask local.asid_bits \<and> typ_at (AArch AASIDPool) ptr s; pspace_aligned' s' \<and> pspace_distinct' s' \<and> no_0_obj' s' \<and> valid_arch_state' s' \<and> cur_tcb' s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres dc (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') (do asid_table <- gets (arm_asid_table \<circ> arch_state);
when (asid_table (asid_high_bits_of base) = Some ptr) (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od)
od) (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
when (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. corres dc (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') (do asid_table <- gets (arm_asid_table \<circ> arch_state);
when (asid_table (asid_high_bits_of base) = Some ptr) (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od)
od) (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
when (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. corres dc (?Q17 s s') (?Q'17 s s') (do asid_table <- gets (arm_asid_table \<circ> arch_state);
when (asid_table (asid_high_bits_of base) = Some ptr) (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od)
od) (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
when (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
od)
 2. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ?Q17 s s' sa
 3. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ?Q'17 s s' sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> corres dc (?R21 s s' rv) (?R'21 s s' rv') (when (rv (asid_high_bits_of base) = Some ptr) (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := rv(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od)) (when (rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od))
 2. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>?R21 s s'\<rbrace>
 3. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?R'21 s s'\<rbrace>
 4. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 5. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> (rv (asid_high_bits_of base) = Some ptr) = (rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr)
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> corres dc (?P27 s s' rv) (?P'29 s s' rv') (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := rv(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 3. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> ?P27 s s' rv x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> ?P'29 s s' rv' x\<rbrace>
 5. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 6. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> corres dc (?P27 s s' rv) (?P'29 s s' rv') (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := rv(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do pool <- liftM (inv asidpool.ASIDPool) (getObject ptr);
y <- mapM (\<lambda>offset. when (\<exists>y. pool offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 2. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> ?P27 s s' rv x\<rbrace>
 3. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> ?P'29 s s' rv' x\<rbrace>
 4. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 5. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> corres dc (?P27 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))) (?P'29 s s' rv') (do pool <- get_asid_pool ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do x <- getObject ptr;
y <- mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 2. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> ?P27 s s' rv x\<rbrace>
 3. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> ?P'29 s s' rv' x\<rbrace>
 4. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 5. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> corres dc (?R32 s s' rv rv' pool) (?R'32 s s' rv rv' x) (do y <- mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1];
y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>?R32 s s' rv rv'\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>?R'32 s s' rv rv'\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> corres (?r'47 s s' rv rv' pool x) (?P48 s s' rv rv' pool) (?P'50 s s' rv rv' x) (mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1]) (mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1])
 2. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); ?r'47 s s' rv rv' pool x rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 3. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 4. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 5. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. ?P48 s s' rv rv' pool and ?Q49 s s' rv rv' pool\<rbrace>
 6. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. ?P'50 s s' rv rv' x and ?Q'51 s s' rv rv' x\<rbrace>
 7. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 8. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 9. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 10. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (14 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> ?S56 s s' rv rv' pool x\<rbrakk> \<Longrightarrow> corres dc (?P48 s s' rv rv' pool) (?P'50 s s' rv rv' x) (when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od)) (when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od))
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> ?S56 s s' rv rv' pool x\<rbrakk> \<Longrightarrow> \<lbrace>?P48 s s' rv rv' pool\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rva. ?P48 s s' rv rv' pool\<rbrace>
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> ?S56 s s' rv rv' pool x\<rbrakk> \<Longrightarrow> \<lbrace>?P'50 s s' rv rv' x\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rva. ?P'50 s s' rv rv' x\<rbrace>
 4. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]) \<subseteq> ?S56 s s' rv rv' pool x
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. ?P48 s s' rv rv' pool and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. ?P'50 s s' rv rv' x and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]) \<subseteq> ?S56 s s' rv rv' pool x
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> ?S56 s s' rv rv' pool x\<rbrakk> \<Longrightarrow> corres dc (?P48 s s' rv rv' pool) (?P'50 s s' rv rv' x) (when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od)) (when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od))
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> ?S56 s s' rv rv' pool x\<rbrakk> \<Longrightarrow> \<lbrace>?P48 s s' rv rv' pool\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rva. ?P48 s s' rv rv' pool\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> ?S56 s s' rv rv' pool x\<rbrakk> \<Longrightarrow> \<lbrace>?P'50 s s' rv rv' x\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rva. ?P'50 s s' rv rv' x\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. ?P48 s s' rv rv' pool and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. ?P'50 s s' rv rv' x and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> corres dc (?P48 s s' rv rv' pool) (?P'50 s s' rv rv' x) (when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od)) (when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od))
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>?P48 s s' rv rv' pool\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rva. ?P48 s s' rv rv' pool\<rbrace>
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>?P'50 s s' rv rv' x\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rva. ?P'50 s s' rv rv' x\<rbrace>
 4. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 5. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. ?P48 s s' rv rv' pool and ?Q49 s s' rv rv' pool\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. ?P'50 s s' rv rv' x and ?Q'51 s s' rv rv' x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> corres dc (?P48 s s' rv rv' pool) (?P'50 s s' rv rv' x) (when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od)) (when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od))
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>?P48 s s' rv rv' pool\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rva. ?P48 s s' rv rv' pool\<rbrace>
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>?P'50 s s' rv rv' x\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rva. ?P'50 s s' rv rv' x\<rbrace>
 4. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 5. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. ?P48 s s' rv rv' pool and ?Q49 s s' rv rv' pool\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. ?P'50 s s' rv rv' x and ?Q'51 s s' rv rv' x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> corres dc (?Q71 s s' rv rv' pool x xa y) (?Q'71 s s' rv rv' pool x xa y) (when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od)) (when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od))
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> ?Q71 s s' rv rv' pool x xa y sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> ?Q'71 s s' rv rv' pool x xa y sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) = (\<exists>ya. inv asidpool.ASIDPool x y = Some ya)
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> corres dc (?P73 s s' rv rv' pool x xa y) (?P'73 s s' rv rv' pool x xa y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od)
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> ?P73 s s' rv rv' pool x xa y sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> ?P'73 s s' rv rv' pool x xa y sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> corres dc (?P73 s s' rv rv' pool x xa y) (?P'73 s s' rv rv' pool x xa y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od)
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> ?P73 s s' rv rv' pool x xa y sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> ?P'73 s s' rv rv' pool x xa y sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> corres dc (?P73 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa) (?P'73 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) (do y <- flushSpace (base + xa);
invalidateASIDEntry (base + xa)
od)
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> ?P73 s s' rv rv' pool x xa y sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> ?P'73 s s' rv rv' pool x xa y sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s s' rv rv' pool x xa rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R80 s s' rv rv' pool x xa rva) (?R'80 s s' rv rv' pool x xa rv'a) (invalidate_asid_entry (base + xa)) (invalidateASIDEntry (base + xa))
 2. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flush_space (base + xa) \<lbrace>?R80 s s' rv rv' pool x xa\<rbrace>
 3. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?Q'86 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flushSpace (base + xa) \<lbrace>?R'80 s s' rv rv' pool x xa\<rbrace>
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> (K (base + y \<le> mask local.asid_bits \<and> base + y \<noteq> 0) and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and unique_table_refs \<circ> caps_of_state and valid_global_objs and valid_vs_lookup and valid_arch_state and vspace_at_asid (base + y) (the (pool (UCAST(32 \<rightarrow> 10) y))) and ?Q88 s s' rv rv' pool x xa y) sa
 5. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'86 s s' rv rv' pool x xa y) sa
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 7. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 9. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?Q88 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flush_space (base + xa) \<lbrace>\<lambda>rva. valid_vspace_objs and valid_asid_map and K (base + xa \<le> mask local.asid_bits \<and> base + xa \<noteq> 0) and vspace_at_asid (base + xa) (the (pool (UCAST(32 \<rightarrow> 10) xa))) and valid_vs_lookup and unique_table_refs \<circ> caps_of_state and valid_global_objs and valid_arch_state and pspace_aligned and pspace_distinct\<rbrace>
 2. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?Q'86 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flushSpace (base + xa) \<lbrace>\<lambda>rv'a. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> (K (base + y \<le> mask local.asid_bits \<and> base + y \<noteq> 0) and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and unique_table_refs \<circ> caps_of_state and valid_global_objs and valid_vs_lookup and valid_arch_state and vspace_at_asid (base + y) (the (pool (UCAST(32 \<rightarrow> 10) y))) and ?Q88 s s' rv rv' pool x xa y) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'86 s s' rv rv' pool x xa y) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?P'152 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flush_space (base + xa) \<lbrace>\<lambda>rv s. (unique_table_refs \<circ> caps_of_state) s \<and> valid_global_objs s \<and> valid_arch_state s \<and> pspace_aligned s \<and> pspace_distinct s\<rbrace>
 2. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?Q'86 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flushSpace (base + xa) \<lbrace>\<lambda>rv'a. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> (K (base + y \<le> mask local.asid_bits \<and> base + y \<noteq> 0) and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and unique_table_refs \<circ> caps_of_state and valid_global_objs and valid_vs_lookup and valid_arch_state and vspace_at_asid (base + y) (the (pool (UCAST(32 \<rightarrow> 10) y))) and (\<lambda>a. valid_vspace_objs a \<and> valid_asid_map a \<and> K (base + y \<le> mask local.asid_bits \<and> base + y \<noteq> 0) a \<and> vspace_at_asid (base + y) (the (pool (UCAST(32 \<rightarrow> 10) y))) a \<and> valid_vs_lookup a \<and> ?P'152 s s' rv rv' pool x xa y a)) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'86 s s' rv rv' pool x xa y) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s s' rv' x xa. xa \<le> 2 ^ local.asid_low_bits - 1 \<Longrightarrow> \<lbrace>?P'152 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)) x xa xa\<rbrace> flush_space (base + xa) \<lbrace>\<lambda>rv s. unique_table_refs (caps_of_state s) \<and> valid_global_objs s \<and> valid_arch_state s \<and> pspace_aligned s \<and> pspace_distinct s\<rbrace>
 2. \<And>s s' rv rv' pool x xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); xa \<le> 2 ^ local.asid_low_bits - 1; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?Q'86 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' pool x xa xa\<rbrace> flushSpace (base + xa) \<lbrace>\<lambda>rv'a. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)) sa\<rbrakk> \<Longrightarrow> (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) \<longrightarrow> (K (base + y \<le> mask local.asid_bits \<and> base + y \<noteq> 0) and valid_asid_map and valid_vspace_objs and pspace_aligned and pspace_distinct and unique_table_refs \<circ> caps_of_state and valid_global_objs and valid_vs_lookup and valid_arch_state and vspace_at_asid (base + y) (the (pool (UCAST(32 \<rightarrow> 10) y))) and (\<lambda>a. valid_vspace_objs a \<and> valid_asid_map a \<and> K (base + y \<le> mask local.asid_bits \<and> base + y \<noteq> 0) a \<and> vspace_at_asid (base + y) (the (pool (UCAST(32 \<rightarrow> 10) y))) a \<and> valid_vs_lookup a \<and> ?P'152 s s' rv rv' pool x xa y a)) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'86 s s' rv rv' pool x xa y) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; invs sa; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y\<rbrakk> \<Longrightarrow> base + xa \<le> mask local.asid_bits \<and> base + xa \<noteq> 0 \<and> valid_asid_map sa \<and> valid_vspace_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> unique_table_refs (caps_of_state sa) \<and> valid_global_objs sa \<and> valid_vs_lookup sa \<and> valid_arch_state sa \<and> vspace_at_asid (base + xa) y sa \<and> valid_vspace_objs sa \<and> valid_asid_map sa \<and> base + xa \<le> mask local.asid_bits \<and> base + xa \<noteq> 0 \<and> vspace_at_asid (base + xa) y sa \<and> valid_vs_lookup sa \<and> unique_table_refs (caps_of_state sa) \<and> valid_global_objs sa \<and> valid_arch_state sa \<and> pspace_aligned sa \<and> pspace_distinct sa
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<le> mask local.asid_bits \<and> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<le> mask local.asid_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> 2 ^ local.asid_low_bits * word_of_nat q + xa < 2 ^ local.asid_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> 2 ^ local.asid_low_bits * word_of_nat q + xa < 2 ^ local.asid_bits
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> xa < 2 ^ local.asid_low_bits
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ ?m260 x xa sa y q
 3. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 4. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 5. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits = ?m260 x xa sa y q + local.asid_low_bits
 6. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 7. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 8. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 9. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 10. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ ?m260 x xa sa y q
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 3. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 4. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits = ?m260 x xa sa y q + local.asid_low_bits
 5. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 6. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 7. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 8. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 9. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 3. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits = local.asid_high_bits + local.asid_low_bits
 4. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 5. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 6. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 7. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 8. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 10. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits = local.asid_high_bits + local.asid_low_bits
 3. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 4. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 5. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 7. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 9. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> 2 ^ local.asid_high_bits \<le> 2 ^ (LENGTH(32) - local.asid_low_bits)
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits = local.asid_high_bits + local.asid_low_bits
 3. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 4. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 5. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 7. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 9. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ local.asid_high_bits\<rbrakk> \<Longrightarrow> local.asid_bits = local.asid_high_bits + local.asid_low_bits
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; 2 ^ local.asid_low_bits * word_of_nat q < 2 ^ local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ (local.asid_bits - local.asid_low_bits)\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; base = 2 ^ local.asid_low_bits * word_of_nat q\<rbrakk> \<Longrightarrow> 2 ^ (32 - local.asid_low_bits) < 2 ^ LENGTH(32)
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < word_of_nat (2 ^ (32 - local.asid_low_bits))\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 3. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ (local.asid_bits - local.asid_low_bits)\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 4. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 5. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 7. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 9. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < word_of_nat (2 ^ (32 - local.asid_low_bits))\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ (LENGTH(32) - local.asid_low_bits)
 2. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ (local.asid_bits - local.asid_low_bits)\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ (local.asid_bits - local.asid_low_bits)\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 2 ^ local.asid_low_bits; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (2 ^ local.asid_low_bits * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 2 ^ (32 - local.asid_low_bits); base = 2 ^ local.asid_low_bits * word_of_nat q; word_of_nat q < 2 ^ (17 - local.asid_low_bits)\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y q. \<lbrakk>xa < 0x400; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (0x400 * word_of_nat q))) None] \<rhd> ptr) sa; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; q < 4194304; base = 0x400 * word_of_nat q; word_of_nat q < 0x80\<rbrakk> \<Longrightarrow> word_of_nat q < 2 ^ local.asid_high_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0 \<and> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None], ptr), [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None], y) \<in> (vs_lookup1 sa)\<^sup>+
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None], ptr), [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None], y) \<in> vs_lookup1 sa
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (?r287 x xa sa y, y) \<in> vs_refs (ArchObj (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))))
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] = [?r287 x xa sa y, VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None]
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (?r287 x xa sa y, y) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(10 \<rightarrow> 32) r) (Some AASIDPool), x)) ` graph_of (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] = [?r287 x xa sa y, VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None]
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> ?x293 x xa sa y \<in> graph_of (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (?r287 x xa sa y, y) = (case ?x293 x xa sa y of (r, x) \<Rightarrow> (VSRef (UCAST(10 \<rightarrow> 32) r) (Some AASIDPool), x))
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] = [?r287 x xa sa y, VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None]
 4. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 5. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 7. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 9. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (?r287 x xa sa y, y) = (case (UCAST(32 \<rightarrow> 10) xa, y) of (r, x) \<Rightarrow> (VSRef (UCAST(10 \<rightarrow> 32) r) (Some AASIDPool), x))
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] = [?r287 x xa sa y, VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None]
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> ?r287 x xa sa y = VSRef (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) (Some AASIDPool)
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] = [?r287 x xa sa y, VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None]
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> [VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] = [VSRef (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None]
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa && mask local.asid_low_bits = xa && mask local.asid_low_bits \<and> (base + xa >> local.asid_low_bits) && mask 7 = (base >> local.asid_low_bits) && mask 7
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa && mask local.asid_low_bits = xa && mask local.asid_low_bits
 2. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (base + xa >> local.asid_low_bits) && mask 7 = (base >> local.asid_low_bits) && mask 7
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> xa && mask local.asid_low_bits = base + xa && mask local.asid_low_bits
 2. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (base + xa >> local.asid_low_bits) && mask 7 = (base >> local.asid_low_bits) && mask 7
 3. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 4. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 6. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 8. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> (base + xa >> local.asid_low_bits) && mask 7 = (base >> local.asid_low_bits) && mask 7
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa >> local.asid_low_bits = base >> local.asid_low_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa < 2 ^ local.asid_low_bits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (xa && mask local.asid_low_bits) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; \<forall>p. (\<exists>rs. (rs \<rhd> p) sa) \<longrightarrow> (\<forall>ao. ako_at ao p sa \<longrightarrow> valid_vspace_obj ao sa); valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> base + xa && ~~ mask local.asid_low_bits = base && ~~ mask local.asid_low_bits
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef (base + xa && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (base + xa))) None] \<rhd> y) sa\<rbrakk> \<Longrightarrow> base + xa \<noteq> 0
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of 0)) None] \<rhd> y) sa; base + xa = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of 0)) None] \<rhd> y) sa; base + xa = 0; base \<le> base + xa\<rbrakk> \<Longrightarrow> False
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of 0)) None] \<rhd> y) sa; base + xa = 0\<rbrakk> \<Longrightarrow> base \<le> base + xa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x xa sa y. \<lbrakk>ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef 0 None] \<rhd> ptr) sa; inv asidpool.ASIDPool x 0 = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; \<forall>p ref. (ref \<unrhd> p) sa \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state sa (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef 0 None] \<rhd> y) sa; xa = 0; base = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of 0)) None] \<rhd> y) sa; base + xa = 0\<rbrakk> \<Longrightarrow> base \<le> base + xa
 3. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 5. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 7. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
A total of 15 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x_ \<circ> UCAST(10 \<rightarrow> 32))) ptr sa_; ([VSRef 0 None] \<rhd> ptr) sa_; inv asidpool.ASIDPool x_ 0 = Some y_; valid_objs sa_; pspace_aligned sa_; pspace_distinct sa_; if_live_then_nonz_cap sa_; zombies_final sa_; sym_refs (state_refs_of sa_); sym_refs (state_hyp_refs_of sa_); valid_mdb sa_; valid_ioc sa_; valid_idle sa_; only_idle sa_; if_unsafe_then_cap sa_; valid_reply_caps sa_; valid_reply_masters sa_; valid_global_refs sa_; valid_arch_state sa_; valid_irq_node sa_; valid_irq_handlers sa_; valid_irq_states sa_; valid_machine_state sa_; valid_vspace_objs sa_; \<forall>p ref. (ref \<unrhd> p) sa_ \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state sa_ (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_table_caps sa_; unique_table_caps (caps_of_state sa_); unique_table_refs (caps_of_state sa_); valid_global_objs sa_; valid_kernel_mappings sa_; equal_kernel_mappings sa_; valid_asid_map sa_; valid_global_vspace_mappings sa_; pspace_in_kernel_window sa_; cap_refs_in_kernel_window sa_; pspace_respects_device_region sa_; cap_refs_respects_device_region sa_; cur_tcb sa_; ([VSRef 0 (Some AASIDPool), VSRef 0 None] \<rhd> y_) sa_; xa_ = 0; base = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of 0)) None] \<rhd> y) sa; base + xa = 0\<rbrakk> \<Longrightarrow> base \<le> base + xa
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x xa sa y. \<lbrakk>xa \<le> 2 ^ local.asid_low_bits - 1; ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr sa; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa; base \<le> mask local.asid_bits; inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y; valid_objs sa; pspace_aligned sa; pspace_distinct sa; if_live_then_nonz_cap sa; zombies_final sa; sym_refs (state_refs_of sa); sym_refs (state_hyp_refs_of sa); valid_mdb sa; valid_ioc sa; valid_idle sa; only_idle sa; if_unsafe_then_cap sa; valid_reply_caps sa; valid_reply_masters sa; valid_global_refs sa; valid_arch_state sa; valid_irq_node sa; valid_irq_handlers sa; valid_irq_states sa; valid_machine_state sa; valid_vspace_objs sa; valid_vs_lookup sa; valid_table_caps sa; unique_table_caps (caps_of_state sa); unique_table_refs (caps_of_state sa); valid_global_objs sa; valid_kernel_mappings sa; equal_kernel_mappings sa; valid_asid_map sa; valid_global_vspace_mappings sa; pspace_in_kernel_window sa; cap_refs_in_kernel_window sa; pspace_respects_device_region sa; cap_refs_respects_device_region sa; cur_tcb sa; ([VSRef 0 (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of 0)) None] \<rhd> y) sa; base + xa = 0\<rbrakk> \<Longrightarrow> xa < 2 ^ local.asid_low_bits
 2. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 4. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' rv rv' pool x xa y sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1]); inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool; (pspace_aligned' and pspace_distinct' and no_0_obj') sa\<rbrakk> \<Longrightarrow> (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> no_0_obj' a)) sa
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 3. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 4. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 5. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) xa) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 3. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x xa. xa \<le> 2 ^ local.asid_low_bits - 1 \<Longrightarrow> \<lbrace>invs and ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace> when (\<exists>y. inv asidpool.ASIDPool x (UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) xa)) = Some y) (do y <- flush_space (base + xa);
invalidate_asid_entry (base + xa)
od) \<lbrace>\<lambda>rv. invs and ako_at (arch_kernel_obj.ASIDPool (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits)\<rbrace>
 2. \<And>s s' rv rv' pool x xa y. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); (xa, y) \<in> set (zip [0 .e. 2 ^ local.asid_low_bits - 1] [0 .e. 2 ^ local.asid_low_bits - 1])\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace> when (\<exists>ya. inv asidpool.ASIDPool x y = Some ya) (do ya <- flushSpace (base + y);
invalidateASIDEntry (base + y)
od) \<lbrace>\<lambda>rv. pspace_aligned' and pspace_distinct' and no_0_obj'\<rbrace>
 3. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> length [0 .e. 2 ^ local.asid_low_bits - 1] = length [0 .e. 2 ^ local.asid_low_bits - 1]
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R47 s s' rv rv' pool x rva) (?R'47 s s' rv rv' pool x rv'a) (do y <- modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>);
gets cur_thread >>= set_vm_root
od) (do y <- modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>);
getCurThread >>= setVMRoot
od)
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R47 s s' rv rv' pool x\<rbrace>
 3. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>?R'47 s s' rv rv' pool x\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 5. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 7. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 8. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 9. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (12 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> corres (?r'364 s s' rv rv' pool x rva rv'a) (?P365 s s' rv rv' pool x rva) (?P'367 s s' rv rv' pool x rv'a) (modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>)) (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>))
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; ?r'364 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. ?P365 s s' rv rv' pool x rva and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. ?P'367 s s' rv rv' pool x rv'a and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a sa s'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; True; True; (sa, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> (sa\<lparr>arch_state := arch_state sa\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>, s'a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s'a)\<rparr>) \<in> state_relation
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' pool x sa s'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); pspace_relation (kheap sa) (ksPSpace s'a) \<and> ekheap_relation (ekheap sa) (ksPSpace s'a) \<and> sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a) \<and> ready_queues_relation (ready_queues sa) (ksReadyQueues s'a) \<and> ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a) \<and> cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a) \<and> revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a) \<and> asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32) \<and> arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a) \<and> arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a) \<and> arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a) \<and> arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a) \<and> arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a) \<and> arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a) \<and> interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a) \<and> cur_thread sa = ksCurThread s'a \<and> idle_thread sa = ksIdleThread s'a \<and> machine_state sa = ksMachineState s'a \<and> work_units_completed sa = ksWorkUnitsCompleted s'a \<and> domain_index sa = ksDomScheduleIdx s'a \<and> domain_list sa = ksDomSchedule s'a \<and> cur_domain sa = ksCurDomain s'a \<and> domain_time sa = ksDomainTime s'a\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = asid_high_bits_of base then None else rv' (UCAST(7 \<rightarrow> 32) a)) = (\<lambda>a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) then None else rv' a) \<circ> UCAST(7 \<rightarrow> 32)
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' pool x sa s'a xa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); pspace_relation (kheap sa) (ksPSpace s'a) \<and> ekheap_relation (ekheap sa) (ksPSpace s'a) \<and> sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a) \<and> ready_queues_relation (ready_queues sa) (ksReadyQueues s'a) \<and> ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a) \<and> cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a) \<and> revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a) \<and> asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32) \<and> arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a) \<and> arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a) \<and> arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a) \<and> arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a) \<and> arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a) \<and> arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a) \<and> interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a) \<and> cur_thread sa = ksCurThread s'a \<and> idle_thread sa = ksIdleThread s'a \<and> machine_state sa = ksMachineState s'a \<and> work_units_completed sa = ksWorkUnitsCompleted s'a \<and> domain_index sa = ksDomScheduleIdx s'a \<and> domain_list sa = ksDomSchedule s'a \<and> cur_domain sa = ksCurDomain s'a \<and> domain_time sa = ksDomainTime s'a\<rbrakk> \<Longrightarrow> (if xa = asid_high_bits_of base then None else rv' (UCAST(7 \<rightarrow> 32) xa)) = ((\<lambda>a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) then None else rv' a) \<circ> UCAST(7 \<rightarrow> 32)) xa
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' sa s'a xa. \<lbrakk>pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; xa \<noteq> asid_high_bits_of base; UCAST(7 \<rightarrow> 32) xa = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)\<rbrakk> \<Longrightarrow> rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = None
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' sa s'a xa. \<lbrakk>pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; UCAST(7 \<rightarrow> 32) xa = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)\<rbrakk> \<Longrightarrow> xa = asid_high_bits_of base
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' sa s'a xa n. \<lbrakk>pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; UCAST(7 \<rightarrow> 32) xa = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base); n < size xa\<rbrakk> \<Longrightarrow> xa !! n = asid_high_bits_of base !! n
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' sa s'a xa n. \<lbrakk>pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; n < size xa; \<forall>n. UCAST(7 \<rightarrow> 32) xa !! n = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) !! n\<rbrakk> \<Longrightarrow> xa !! n = asid_high_bits_of base !! n
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' sa s'a xa n. \<lbrakk>pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = armKSASIDTable (ksArchState s'a) \<circ> UCAST(7 \<rightarrow> 32); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; n < size xa; UCAST(7 \<rightarrow> 32) xa !! n = UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) !! n\<rbrakk> \<Longrightarrow> xa !! n = asid_high_bits_of base !! n
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres dc (?R364 s s' rv rv' pool x rva rv'a rvb) (?R'364 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread >>= set_vm_root) (getCurThread >>= setVMRoot)
 2. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>?R364 s s' rv rv' pool x rva rv'a\<rbrace>
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>?R'364 s s' rv rv' pool x rva rv'a\<rbrace>
 4. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 6. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 8. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 10. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> corres (?r'423 s s' rv rv' pool x rva rv'a rvb rv'b) (?P424 s s' rv rv' pool x rva rv'a rvb) (?P'426 s s' rv rv' pool x rva rv'a rv'b) (gets cur_thread) getCurThread
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b rvc rv'c. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b; ?r'423 s s' rv rv' pool x rva rv'a rvb rv'b rvc rv'c\<rbrakk> \<Longrightarrow> corres dc (?R423 s s' rv rv' pool x rva rv'a rvb rv'b rvc) (?R'423 s s' rv rv' pool x rva rv'a rvb rv'b rv'c) (set_vm_root rvc) (setVMRoot rv'c)
 3. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace> gets cur_thread \<lbrace>?R423 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace> getCurThread \<lbrace>?R'423 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrace>
 5. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>\<lambda>rvb. ?P424 s s' rv rv' pool x rva rv'a rvb and ?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace>
 6. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>\<lambda>rv'b. ?P'426 s s' rv rv' pool x rva rv'a rv'b and ?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 8. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 10. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a rvb rv'b rvc rv'c. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> corres dc (?R423 s s' rv rv' pool x rva rv'a rvb rv'b rvc) (?R'423 s s' rv rv' pool x rva rv'a rvb rv'b rv'c) (set_vm_root rvc) (setVMRoot rv'c)
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace> gets cur_thread \<lbrace>?R423 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrace>
 3. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace> getCurThread \<lbrace>?R'423 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace>
 5. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a rvb rv'b rvc rv'c. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b; rvc = rv'c\<rbrakk> \<Longrightarrow> corres dc (?R423 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)) x rva rv'a rvb rv'b rv'c) (?R'423 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)) x rva rv'a rvb rv'b rv'c) (set_vm_root rv'c) (setVMRoot rv'c)
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace> gets cur_thread \<lbrace>?R423 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrace>
 3. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace> getCurThread \<lbrace>?R'423 s s' rv rv' pool x rva rv'a rvb rv'b\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace>
 5. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 7. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 9. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace> gets cur_thread \<lbrace>\<lambda>a. tcb_at a and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs\<rbrace>
 2. \<And>s s' rv rv' pool x rva rv'a rvb rv'b. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a; dc rvb rv'b\<rbrakk> \<Longrightarrow> \<lbrace>?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace> getCurThread \<lbrace>\<lambda>a. pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' a and no_0_obj'\<rbrace>
 3. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q366 s s' rv rv' pool x rva\<rbrace> modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>) \<lbrace>\<lambda>rvb. (\<lambda>_. True) and ?Q425 s s' rv rv' pool x rva rv'a rvb\<rbrace>
 4. \<And>s s' rv rv' pool x rva rv'a. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 s s' rv rv' pool x rv'a\<rbrace> modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<lbrace>\<lambda>rv'b. (\<lambda>_. True) and ?Q'427 s s' rv rv' pool x rva rv'a rv'b\<rbrace>
 5. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q49 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q366 s s' rv rv' pool x rva\<rbrace>
 6. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and ?Q'368 s s' rv rv' pool x rv'a\<rbrace>
 7. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and ?Q49 s s' rv rv' pool\<rbrace>
 8. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 9. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 10. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv s. ((\<lambda>_. True) and (\<lambda>a. (tcb_at (cur_thread a) and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs) a)) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> ((\<lambda>_. True) and (\<lambda>a. (tcb_at (cur_thread a) and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs) a)) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (rv' \<circ> UCAST(7 \<rightarrow> 32))(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); rv' \<circ> UCAST(7 \<rightarrow> 32) = rv\<rbrakk> \<Longrightarrow> \<lbrace>?P'456 s s' rv rv' (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32))\<rbrace> mapM (\<lambda>offset. when (\<exists>y. (inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)) (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> ((\<lambda>_. True) and (\<lambda>a. (tcb_at (cur_thread a) and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs) a)) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := rv(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv' \<circ> UCAST(7 \<rightarrow> 32) = rv; inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32) = pool\<rbrakk> \<Longrightarrow> \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> ((\<lambda>_. True) and (\<lambda>a. (tcb_at (cur_thread a) and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs) a)) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := rv(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> ((\<lambda>_. True) and (\<lambda>a. (tcb_at (cur_thread a) and valid_arch_state and valid_objs and valid_asid_map and unique_table_refs \<circ> caps_of_state and valid_vs_lookup and valid_global_objs and pspace_aligned and pspace_distinct and valid_vspace_objs) a)) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := rv(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> True \<and> ((((((((tcb_at (cur_thread (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> valid_arch_state (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> valid_objs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> valid_asid_map (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> (unique_table_refs \<circ> caps_of_state) (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> valid_vs_lookup (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> valid_global_objs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> pspace_aligned (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> pspace_distinct (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)) \<and> valid_vspace_objs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool. \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> tcb_at (cur_thread s) s \<and> valid_arch_state (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> valid_objs s \<and> valid_asid_map (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool. \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> valid_objs s \<and> valid_asid_map (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>) \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := (asid_table s)(asid_high_bits_of base := None)\<rparr>\<rparr>)\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool. \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r sa. rv = asid_table sa \<and> cur_tcb sa \<and> valid_arch_state sa \<and> valid_objs sa \<and> (valid_asid_map sa \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> (\<forall>x\<in>set [0 .e. 2 ^ local.asid_low_bits - 1]. arm_asid_map (arch_state sa) (base + x) = None)) \<and> unique_table_refs (caps_of_state sa) \<and> valid_vs_lookup sa \<and> valid_global_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_vspace_objs sa\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (8 subgoals):
 1. \<And>s s' rv rv' pool. \<lbrace>?P'456 s s' rv rv' pool\<rbrace> mapM (\<lambda>offset. when (\<exists>y. pool (UCAST(32 \<rightarrow> 10) offset) = Some y) (do y <- flush_space (base + offset);
invalidate_asid_entry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r sa. rv = asid_table sa \<and> cur_tcb sa \<and> valid_arch_state sa \<and> valid_objs sa \<and> valid_asid_map sa \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> (\<forall>x\<le>2 ^ local.asid_low_bits - 1. arm_asid_map (arch_state sa) (base + x) = None) \<and> unique_table_refs (caps_of_state sa) \<and> valid_vs_lookup sa \<and> valid_global_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_vspace_objs sa\<rbrace>
 2. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>sa. True \<and> ?P'456 s s' rv rv' pool sa)\<rbrace>
 4. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 6. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 7. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 8. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>rv'a. (\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' rv rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv' = armKSASIDTable (ksArchState s) \<and> ((\<lambda>_. True) and (\<lambda>a. ((\<lambda>_. True) and (\<lambda>a. (pspace_aligned' and pspace_distinct' and valid_arch_state' and tcb_at' (ksCurThread a) and no_0_obj') a)) (a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. rv'(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState a)\<rparr>))) s\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv' = armKSASIDTable (ksArchState s) \<and> True \<and> True \<and> (((pspace_aligned' (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<and> pspace_distinct' (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>)) \<and> valid_arch_state' (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>)) \<and> tcb_at' (ksCurThread (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>)) (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>)) \<and> no_0_obj' (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>)\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r s. rv' = armKSASIDTable (ksArchState s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' (s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState s))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) := None)) (ksArchState s)\<rparr>) \<and> tcb_at' (ksCurThread s) s \<and> no_0_obj' s\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r sa. rv' = armKSASIDTable (ksArchState sa) \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> valid_arch_state' sa \<and> tcb_at' (ksCurThread sa) sa \<and> no_0_obj' sa\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32)) rv' x\<rbrace> mapM (\<lambda>offset. when (\<exists>y. inv asidpool.ASIDPool x offset = Some y) (do y <- flushSpace (base + offset);
invalidateASIDEntry (base + offset)
od)) [0 .e. 2 ^ local.asid_low_bits - 1] \<lbrace>\<lambda>r sa. rv' = armKSASIDTable (ksArchState sa) \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> valid_arch_state' sa \<and> cur_tcb' sa \<and> no_0_obj' sa\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and ?Q'51 s s' rv rv' x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>s s' rv rv' pool x xa sa. \<lbrakk>rv = rv' \<circ> UCAST(7 \<rightarrow> 32); pool = inv asidpool.ASIDPool x \<circ> UCAST(10 \<rightarrow> 32); xa \<in> set [0 .e. 2 ^ local.asid_low_bits - 1]; rv' = armKSASIDTable (ksArchState sa) \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> valid_arch_state' sa \<and> cur_tcb' sa \<and> no_0_obj' sa\<rbrakk> \<Longrightarrow> (if \<exists>y. inv asidpool.ASIDPool x xa = Some y then \<lambda>s. rv' = armKSASIDTable (ksArchState s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_arch_state' s \<and> cur_tcb' s \<and> no_0_obj' s else (\<lambda>a. rv' = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)) sa
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 3. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. rv' = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)\<rbrace>
 4. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 5. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 6. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 7. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q42 s s' (rv' \<circ> UCAST(7 \<rightarrow> 32))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool. invs and ako_at (arch_kernel_obj.ASIDPool pool) ptr and [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and K (is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and (\<lambda>s. True \<and> rv = asid_table s \<and> cur_tcb s \<and> valid_arch_state s \<and> valid_objs s \<and> valid_asid_map s \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr and ako_at (arch_kernel_obj.ASIDPool pool) ptr and valid_asid_map and K (is_aligned base local.asid_low_bits)) s \<and> unique_table_refs (caps_of_state s) \<and> valid_vs_lookup s \<and> valid_global_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_vspace_objs s)\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. rv' = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)\<rbrace>
 3. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 5. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 6. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>s s' rv rv'. rv = (\<lambda>x. rv' (UCAST(7 \<rightarrow> 32) x)) \<Longrightarrow> \<lbrace>?Q42 s s' (\<lambda>x. rv' (UCAST(7 \<rightarrow> 32) x))\<rbrace> get_asid_pool ptr \<lbrace>\<lambda>pool x. invs x \<and> ako_at (arch_kernel_obj.ASIDPool pool) ptr x \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) x \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> (\<lambda>x. rv' (UCAST(7 \<rightarrow> 32) x)) = asid_table x \<and> cur_tcb x \<and> valid_arch_state x \<and> valid_objs x \<and> valid_asid_map x \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) x \<and> ako_at (arch_kernel_obj.ASIDPool pool) ptr x \<and> valid_asid_map x \<and> is_aligned base local.asid_low_bits \<and> unique_table_refs (caps_of_state x) \<and> valid_vs_lookup x \<and> valid_global_objs x \<and> pspace_aligned x \<and> pspace_distinct x \<and> valid_vspace_objs x\<rbrace>
 2. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. rv' = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)\<rbrace>
 3. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and ?Q42 s s' rv) x\<rbrace>
 4. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 5. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 6. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv rv'. rv = rv' \<circ> UCAST(7 \<rightarrow> 32) \<Longrightarrow> \<lbrace>?Q'41 s s' rv'\<rbrace> getObject ptr \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. rv' = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)\<rbrace>
 2. \<And>s s'. \<lbrace>?Q21 s s'\<rbrace> gets (arm_asid_table \<circ> arch_state) \<lbrace>\<lambda>rv x. rv (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and (\<lambda>a. \<forall>pool. ako_at (arch_kernel_obj.ASIDPool pool) ptr a \<longrightarrow> invs a \<and> ako_at (arch_kernel_obj.ASIDPool pool) ptr a \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) a \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> rv = asid_table a \<and> cur_tcb a \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) a \<and> ako_at (arch_kernel_obj.ASIDPool pool) ptr a \<and> valid_asid_map a \<and> is_aligned base local.asid_low_bits \<and> unique_table_refs (caps_of_state a) \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vspace_objs a)) x\<rbrace>
 3. \<And>s s'. \<lbrace>?Q'21 s s'\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>rv' x. rv' (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'41 s s' rv') x\<rbrace>
 4. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and ?Q21 s s') sa
 5. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and ?Q'21 s s') sa proof (prove)
goal (2 subgoals):
 1. \<And>s s' sa. (invs and (\<lambda>y. is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits) and typ_at (AArch AASIDPool) ptr) sa \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (arm_asid_table \<circ> arch_state) s (asid_high_bits_of base) = Some ptr \<longrightarrow> (typ_at (AArch AASIDPool) ptr and (\<lambda>a. \<forall>pool. ako_at (arch_kernel_obj.ASIDPool pool) ptr a \<longrightarrow> invs a \<and> ako_at (arch_kernel_obj.ASIDPool pool) ptr a \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) a \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> (arm_asid_table \<circ> arch_state) s = asid_table a \<and> cur_tcb a \<and> valid_arch_state a \<and> valid_objs a \<and> valid_asid_map a \<and> is_aligned base local.asid_low_bits \<and> base \<le> mask local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) a \<and> ako_at (arch_kernel_obj.ASIDPool pool) ptr a \<and> valid_asid_map a \<and> is_aligned base local.asid_low_bits \<and> unique_table_refs (caps_of_state a) \<and> valid_vs_lookup a \<and> valid_global_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_vspace_objs a)) s)) sa
 2. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>a. \<forall>ko. ko_at' ko ptr a \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. (armKSASIDTable \<circ> ksArchState) s = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)) a)) s)) sa proof (prove)
goal (2 subgoals):
 1. \<And>sa pool. \<lbrakk>invs sa; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; typ_at (AArch AASIDPool) ptr sa; asid_table sa (asid_high_bits_of base) = Some ptr; ako_at (arch_kernel_obj.ASIDPool pool) ptr sa\<rbrakk> \<Longrightarrow> valid_arch_state sa \<and> valid_asid_map sa \<and> valid_global_objs sa \<and> valid_vs_lookup sa \<and> valid_vspace_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> cur_tcb sa \<and> valid_objs sa \<and> unique_table_refs (caps_of_state sa) \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) None] \<rhd> ptr) sa
 2. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>a. \<forall>ko. ko_at' ko ptr a \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. (armKSASIDTable \<circ> ksArchState) s = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)) a)) s)) sa proof (prove)
goal (1 subgoal):
 1. \<And>s s' sa. (pspace_aligned' and pspace_distinct' and no_0_obj' and valid_arch_state' and cur_tcb') sa \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (armKSASIDTable \<circ> ksArchState) s (UCAST(7 \<rightarrow> 32) (asid_high_bits_of base)) = Some ptr \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>a. \<forall>ko. ko_at' ko ptr a \<longrightarrow> (pspace_aligned' and pspace_distinct' and no_0_obj' and (\<lambda>a. (armKSASIDTable \<circ> ksArchState) s = armKSASIDTable (ksArchState a) \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> valid_arch_state' a \<and> cur_tcb' a \<and> no_0_obj' a)) a)) s)) sa proof (prove)
goal:
No subgoals!