theory Fastpath_C

lemma switchToThread_fp_ccorres:
  "ccorres dc xfdc (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj'
                          and valid_pde_mappings' and valid_arch_state'
                          and tcb_at' thread
                          and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte)
                                              \<and> capPDBasePtr (capCap (cteCap cte)) = pd)
                                         (thread + tcbVTableSlot * 0x10)
                          and pd_has_hwasid pd
                          and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd
                                     = set_option (pde_stored_asid v)))
                   (UNIV \<inter> {s. thread_' s = tcb_ptr_to_ctcb_ptr thread}
                         \<inter> {s. cap_pd_' s = pde_Ptr pd}
                         \<inter> {s. stored_hw_asid___struct_pde_C_' s = v}) []
      (Arch.switchToThread thread
            >>= (\<lambda>_. setCurThread thread))
      (Call switchToThread_fp_'proc)" apply (cinit' lift: thread_' cap_pd_' stored_hw_asid___struct_pde_C_') apply (simp add: ARM_H.switchToThread_def bind_assoc
                    setVMRoot_def cap_case_isPageDirectoryCap
               del: Collect_const cong: call_ignore_cong) apply (simp add: getThreadVSpaceRoot_def locateSlot_conv getSlotCap_def
               del: Collect_const cong: call_ignore_cong) apply (simp only: ) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_symb_exec_r, rule_tac xf'="ret__unsigned_'" in ccorres_abstract,
          ceqv, rename_tac "hw_asid_ret") apply (rule ccorres_getCTE, rename_tac cte) apply (rule_tac P="isValidVTableRoot (cteCap cte)
                        \<and> capPDBasePtr (capCap (cteCap cte)) = pd" in ccorres_gen_asm) apply (erule conjE, drule isValidVTableRootD) apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_catch_bindE_symb_exec_l,
            rule findPDForASID_inv,
            rule empty_fail_findPDForASID) apply (rename_tac "pd_found") apply (rule_tac P="pd_found \<noteq> pd"
                    in ccorres_case_bools2) apply (simp add: bindE_assoc catch_liftE_bindE bind_assoc
                         checkPDNotInASIDMap_def
                         checkPDASIDMapMembership_def
                         catch_throwError) apply (rule ccorres_stateAssert) apply (rule ccorres_False[where P'=UNIV]) apply (simp add: catch_liftE bind_assoc
                   del: Collect_const cong: call_ignore_cong) apply (rule monadic_rewrite_ccorres_assemble[rotated]) apply (rule monadic_rewrite_bind_head) apply (rule_tac pd=pd and v=v
                     in armv_contextSwitch_HWASID_fp_rewrite) apply (ctac(no_vcg) add: armv_contextSwitch_HWASID_ccorres) apply (simp add: storeWordUser_def bind_assoc case_option_If2
                         split_def
                    del: Collect_const) apply (simp only: dmo_clearExMonitor_setCurThread_swap) apply (rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp del: rf_sr_upd_safe) apply (clarsimp simp: setCurThread_def simpler_modify_def
                                    rf_sr_def cstate_relation_def Let_def
                                    carch_state_relation_def cmachine_state_relation_def) apply (ctac add: clearExMonitor_fp_ccorres) apply wp apply (simp add: guard_is_UNIV_def) apply wp apply (simp add: bind_assoc checkPDNotInASIDMap_def
                       checkPDASIDMapMembership_def) apply (rule ccorres_stateAssert) apply (rule ccorres_False[where P'=UNIV]) apply simp apply (wp findPDForASID_pd_at_wp)[1] apply (simp del: Collect_const) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (clarsimp simp: pd_has_hwasid_def cte_level_bits_def
                        field_simps cte_wp_at_ctes_of
                        pd_at_asid'_def word_0_sle_from_less
                        isCap_simps invs_valid_pspace'
              simp del: Collect_const rf_sr_upd_safe) apply (frule_tac P="\<lambda>Sf. Sf x = S'" for x S'
            in subst[OF meta_eq_to_obj_eq, OF asid_map_pd_to_hwasids_def]) apply (clarsimp simp: isCap_simps dest!: isValidVTableRootD) apply (rule context_conjI) apply (drule singleton_eqD[OF sym]) apply clarsimp apply (fastforce simp: ran_def) apply (frule ctes_of_valid', clarsimp, clarsimp simp: valid_cap'_def) apply (auto simp: singleton_eq_o2s projectKOs obj_at'_def
                    pde_stored_asid_def split: if_split_asm) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>cap_pd = pde_Ptr pd\<rbrace> \<inter> \<lbrace>\<acute>stored_hw_asid___struct_pde_C = v\<rbrace>) [] (do _ <- Arch.switchToThread thread;
setCurThread thread
od) (Call switchToThread_fp_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q530 stored_hw_asid___struct_pde_C cap_pd threada) (?Q'530 stored_hw_asid___struct_pde_C cap_pd threada) [SKIP] (do _ <- Arch.switchToThread thread;
setCurThread thread
od) (\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(stored_hw_asid___struct_pde_C);;
(\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned;;
(CALL armv_contextSwitch_HWASID_'proc(cap_pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== threada;;
CALL clearExMonitor_fp_'proc()))))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q530 stored_hw_asid___struct_pde_C cap_pd threada s \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (2 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (do threadRootSlot <- getThreadVSpaceRoot thread;
threadRoot <- getSlotCap threadRootSlot;
y <- (if if isArchObjectCap threadRoot then if isPageDirectoryCap (capCap threadRoot) then capPDMappedASID (capCap threadRoot) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap threadRoot)));
whenE (capPDBasePtr (capCap threadRoot) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap threadRoot)) (the (capPDMappedASID (capCap threadRoot)))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap threadRoot then if isPageDirectoryCap (capCap threadRoot) then capPDMappedASID (capCap threadRoot) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap threadRoot)) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(stored_hw_asid___struct_pde_C);;
(\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned;;
(CALL armv_contextSwitch_HWASID_'proc(cap_pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q530 stored_hw_asid___struct_pde_C cap_pd threada s \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (2 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbVTableSlot);
y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(stored_hw_asid___struct_pde_C);;
(\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned;;
(CALL armv_contextSwitch_HWASID_'proc(cap_pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q530 stored_hw_asid___struct_pde_C cap_pd threada s \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (2 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbVTableSlot);
y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
(\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned;;
(CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q530 stored_hw_asid___struct_pde_C cap_pd threada s \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (2 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbVTableSlot);
y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (\<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned;;
(CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc())))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q530 stored_hw_asid___struct_pde_C cap_pd threada s \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) (?G'548 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret) [SKIP] (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbVTableSlot);
y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> ?G'548 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s)}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; ?Q530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q530 stored_hw_asid___struct_pde_C cap_pd threada s \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P618 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) a cte) (?P'615 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte) [SKIP] (do y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'615 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte')}}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ?P618 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) s cte\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ?P618 stored_hw_asid___struct_pde_C cap_pd threada s cte) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte) (?P'615 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte) [SKIP] (do y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'615 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte')}}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> capPDMappedASID (capCap (cteCap cte)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte) (?P'615 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte) [SKIP] (do y <- (if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
whenE (capPDBasePtr (capCap (cteCap cte)) \<noteq> pd') $ throw Fault_H.lookup_failure.InvalidRoot;
withoutFailure $ armv_contextSwitch (capPDBasePtr (capCap (cteCap cte))) (the (capPDMappedASID (capCap (cteCap cte))))
odE else throw Fault_H.lookup_failure.InvalidRoot) <catch> (\<lambda>_. do y <- if if isArchObjectCap (cteCap cte) then if isPageDirectoryCap (capCap (cteCap cte)) then capPDMappedASID (capCap (cteCap cte)) \<noteq> None else False else False then checkPDNotInASIDMap (capPDBasePtr (capCap (cteCap cte))) else return ();
globalPD <- gets (armKSGlobalPD \<circ> ksArchState);
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'615 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte')}}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte) (?P'615 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte) [SKIP] (do y <- doE pd' <- findPDForASID (the (capPDMappedASID (capCap (cteCap cte))));
y <- whenE (pd \<noteq> pd') (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>_. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> ?P'615 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte')}}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (6 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte rv. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte rv) (?Q'638 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte rv) [SKIP] (do a <- doE y <- whenE (pd \<noteq> rv) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>?Q632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> ?Q'638 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (6 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?Q'638 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do a <- doE y <- whenE (pd \<noteq> pd_found) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>?Q632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> ?Q'638 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?S652 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do a <- doE y <- whenE (pd \<noteq> pd_found) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); \<not> pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do a <- doE y <- whenE (pd \<noteq> pd_found) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> ?R647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> ?S652 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R647 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) (?S652 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do y <- stateAssert (\<lambda>s. pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s))) [];
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
y <- doMachineOp (setCurrentPD (addrFromKPPtr globalPD));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); \<not> pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do a <- doE y <- whenE (pd \<noteq> pd_found) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> ?R647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> ?S652 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P660 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) (?S652 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
y <- doMachineOp (setCurrentPD (addrFromKPPtr globalPD));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); \<not> pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do a <- doE y <- whenE (pd \<noteq> pd_found) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> ?P660 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> ?S652 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (6 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); \<not> pd_found \<noteq> pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd_found) [SKIP] (do a <- doE y <- whenE (pd \<noteq> pd_found) (throwError Fault_H.lookup_failure.InvalidRoot);
liftE (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte)))))
odE <catch> (\<lambda>a. do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od);
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (6 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?T647 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) [SKIP] (do a <- armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte))));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ?T647 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> monadic_rewrite (?F665 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?E665 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?Q669 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) (do a <- armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte))));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (?f665 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found)
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P671 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) [SKIP] (?f665 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> (?P671 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and ?Q669 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> monadic_rewrite (?F665 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?E665 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) (?Q669 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) (armv_contextSwitch pd (the (capPDMappedASID (capCap (cteCap cte))))) (?g675 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found)
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P671 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) [SKIP] (do a <- ?g675 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> (?P671 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and ?Q669 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (6 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P671 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) (?U650 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd) [SKIP] (do a <- doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v)));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> (?P671 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> ?U650 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv)}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found rv xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q683 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found rv) (?Q'697 hw_asid_ret cte rv xfdca) [SKIP] (do _ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc())
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>?Q683 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'696 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv t rva})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada
flex-flex pairs:
\<lambda>hw_asid_ret cte t rv. ?Q'697 hw_asid_ret cte rv (xfdc t) \<equiv>\<^sup>? \<lambda>hw_asid_ret cte. ?Q'696 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q683 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()) (?Q'697 hw_asid_ret cte () xfdca) [SKIP] (do _ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc())
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>?Q683 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'696 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv t rva})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada
flex-flex pairs:
\<lambda>hw_asid_ret cte t rv. ?Q'697 hw_asid_ret cte rv (xfdc t) \<equiv>\<^sup>? \<lambda>hw_asid_ret cte. ?Q'696 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q683 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()) (?Q'697 hw_asid_ret cte () xfdca) [SKIP] (do _ <- setCurThread thread;
doMachineOp ARM.clearExMonitor
od) (\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc())
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>?Q683 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'696 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv t rva})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada
flex-flex pairs:
\<lambda>hw_asid_ret cte t rv. ?Q'697 hw_asid_ret cte rv (xfdc t) \<equiv>\<^sup>? \<lambda>hw_asid_ret cte. ?Q'696 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd proof (prove)
goal (10 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P734 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()) (?Q'697 hw_asid_ret cte () xfdca) [] (setCurThread thread) (\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread)
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd; dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_) (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv') [SKIP] (doMachineOp ARM.clearExMonitor) (CALL clearExMonitor_fp_'proc())
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R732 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()\<rbrace> setCurThread thread \<lbrace>?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca)
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. ?P734 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a and ?R732 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a\<rbrace>
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 8. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {sa. (rv \<noteq> pd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> sa \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'696 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') rv t rva})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 9. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 10. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada
flex-flex pairs:
\<lambda>hw_asid_ret cte t rv. ?Q'697 hw_asid_ret cte rv (xfdc t) \<equiv>\<^sup>? \<lambda>hw_asid_ret cte. ?Q'696 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd proof (prove)
goal (10 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread {s. \<exists>(rv, \<sigma>')\<in>fst (setCurThread thread \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd; dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_) (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv') [SKIP] (doMachineOp ARM.clearExMonitor) (CALL clearExMonitor_fp_'proc())
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R732 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()\<rbrace> setCurThread thread \<lbrace>?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca)
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R732 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a\<rbrace>
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 8. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 9. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 10. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (10 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca \<sigma>. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (setCurThread thread \<sigma>). (\<sigma>', globals_update (ksCurThread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread)) s) \<in> rf_sr \<and> dc rv (xfdc (globals_update (ksCurThread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread)) s))}
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd; dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_) (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv') [SKIP] (doMachineOp ARM.clearExMonitor) (CALL clearExMonitor_fp_'proc())
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R732 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()\<rbrace> setCurThread thread \<lbrace>?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca)
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R732 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a\<rbrace>
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 8. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 9. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 10. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (10 subgoals):
 1. \<And>cte \<sigma> x y. \<lbrakk>pd = capPDBasePtr (capCap (cteCap cte)); (\<sigma>, x) \<in> rf_sr; isArchObjectCap (cteCap cte); isPageDirectoryCap (capCap (cteCap cte)); capPDMappedASID (capCap (cteCap cte)) = Some y\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCurThread thread \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (ksCurThread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread)) x) \<in> rf_sr
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd; dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_) (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv') [SKIP] (doMachineOp ARM.clearExMonitor) (CALL clearExMonitor_fp_'proc())
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R732 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()\<rbrace> setCurThread thread \<lbrace>?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca)
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R732 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a\<rbrace>
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 8. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 9. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 10. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (9 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd; dc uu_ rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_) (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca uu_ rv') [SKIP] (doMachineOp ARM.clearExMonitor) (CALL clearExMonitor_fp_'proc())
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R732 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()\<rbrace> setCurThread thread \<lbrace>?Q728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'728 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca)
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R732 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 8. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 9. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (8 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdc. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R732 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd ()\<rbrace> setCurThread thread \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>_ rv'. {s. s \<in> UNIV})
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R732 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found a\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 8. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (7 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found xfdca. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>_ rv'. {s. s \<in> UNIV})
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 7. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (6 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y); pd_found = pd\<rbrakk> \<Longrightarrow> \<lbrace>?R691 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte pd\<rbrace> doMachineOp (armv_contextSwitch_HWASID pd (the (pde_stored_asid v))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and ?R691 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte pd_found and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 6. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (5 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do a <- do y <- checkPDNotInASIDMap pd;
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
doMachineOp (setCurrentPD (addrFromKPPtr globalPD))
od;
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd,\<acute>hw_asid);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True) and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (5 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R632 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do y <- stateAssert (\<lambda>s. pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s))) [];
globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
y <- doMachineOp (setCurrentPD (addrFromKPPtr globalPD));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True) and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>?R632 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (5 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte ex. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P782 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) (?R'636 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) hw_asid_ret cte ex) [SKIP] (do globalPD <- gets (\<lambda>a. armKSGlobalPD (ksArchState a));
y <- doMachineOp (setCurrentPD (addrFromKPPtr globalPD));
_ <- doMachineOp ARM.clearExMonitor;
setCurThread thread
od) (CALL armv_contextSwitch_HWASID_'proc(pde_Ptr pd);;
(\<acute>ksCurThread :== tcb_ptr_to_ctcb_ptr thread;;
CALL clearExMonitor_fp_'proc()))
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True) and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>\<lambda>a b. pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState b)) \<longrightarrow> ?P782 stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte a b\<rbrace>
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> {sa. (\<forall>rv. sa \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. sa \<in> ?R'636 stored_hw_asid___struct_pde_C cap_pd threada (ret__unsigned_' s) (cte_to_H cte') ex)}}}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 5. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada hw_asid_ret cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState s)) \<longrightarrow> False) \<and> (\<not> pd_found \<noteq> pd \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True) and (pd_has_hwasid pd_found and pd_at_asid' pd_found (the (capPDMappedASID (capCap (cteCap cte)))) and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd_found = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) s)\<rbrace>, \<lbrace>\<lambda>a b. pd \<notin> ran (map_option snd \<circ> armKSASIDMap (ksArchState b)) \<longrightarrow> False\<rbrace>
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. (\<forall>rv. s \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. s \<in> UNIV)}}}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (4 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada cte. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; capPDBasePtr (capCap (cteCap cte)) = pd; isArchObjectCap (cteCap cte) \<and> isPageDirectoryCap (capCap (cteCap cte)) \<and> (\<exists>y. capPDMappedASID (capCap (cteCap cte)) = Some y)\<rbrakk> \<Longrightarrow> \<lbrace>?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte\<rbrace> findPDForASID (the (capPDMappedASID (capCap (cteCap cte)))) \<lbrace>\<lambda>pd_found s. (pd_found \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pd_found = pd \<longrightarrow> pd_has_hwasid pd s \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) s \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))\<rbrace>, \<lbrace>\<lambda>a b. pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState b) a))\<rbrace>
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. (\<forall>rv. s \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. s \<in> UNIV)}}}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 4. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> (?G623 stored_hw_asid___struct_pde_C cap_pd threada cte and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (3 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. (\<forall>rv. s \<in> {s. (rv \<noteq> pd \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<noteq> pd \<longrightarrow> s \<in> {s. hw_asid_'_update (\<lambda>_. hw_asid_' s) (cap_pd_'_update (\<lambda>_. cap_pd) s) \<in> UNIV \<inter> \<lbrace>\<acute>cap_pd = cap_pd\<rbrace> \<inter> \<lbrace>\<acute>hw_asid = the (pde_stored_asid stored_hw_asid___struct_pde_C)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (\<forall>ex. s \<in> UNIV)}}}
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid v)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (3 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread)) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s. (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> hw_asid_' s = the (pde_stored_asid v)}
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid v)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'530 v (pde_Ptr pd) (tcb_ptr_to_ctcb_ptr thread) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 3. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> ?Q'530 stored_hw_asid___struct_pde_C cap_pd threada proof (prove)
goal (2 subgoals):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada s. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; \<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid v)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (\<forall>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL pde_pde_invalid_get_stored_hw_asid_'proc(v);;
\<acute>hw_asid :== UCAST(32 \<rightarrow> 8) \<acute>ret__unsigned {s'. (s, s') \<in> rf_sr}
 2. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> {s. pde_get_tag stored_hw_asid___struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (\<forall>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift stored_hw_asid___struct_pde_C) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift stored_hw_asid___struct_pde_C)) = the (pde_stored_asid stored_hw_asid___struct_pde_C))} proof (prove)
goal (1 subgoal):
 1. \<And>stored_hw_asid___struct_pde_C cap_pd threada s s'. \<lbrakk>stored_hw_asid___struct_pde_C = v; cap_pd = pde_Ptr pd; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (pspace_aligned' and pspace_distinct' and valid_objs' and no_0_obj' and valid_pde_mappings' and valid_arch_state' and tcb_at' thread and cte_wp_at' (\<lambda>cte. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd) (thread + tcbVTableSlot * 0x10) and pd_has_hwasid pd and (\<lambda>s. asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s (thread + 2 ^ cte_level_bits * tcbVTableSlot) = Some cte \<longrightarrow> ((\<lambda>a. pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b)) \<and> (\<forall>pda. (page_directory_at' pda a \<longrightarrow> pd_at_asid' pda (the (capPDMappedASID (capCap (cteCap cte)))) a) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>b. map_option snd (armKSASIDMap (ksArchState a) b))) \<and> (pda = pd \<longrightarrow> pd_has_hwasid pd a \<and> pd_at_asid' pd (the (capPDMappedASID (capCap (cteCap cte)))) a \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState a)) pd = set_option (pde_stored_asid stored_hw_asid___struct_pde_C)))) and (\<lambda>_. isValidVTableRoot (cteCap cte) \<and> capPDBasePtr (capCap (cteCap cte)) = pd)) s) \<and> s' \<in> {s. pde_get_tag stored_hw_asid___struct_pde_C = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> (\<forall>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift stored_hw_asid___struct_pde_C) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (thread + 2 ^ cte_level_bits * tcbVTableSlot)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift stored_hw_asid___struct_pde_C)) = the (pde_stored_asid stored_hw_asid___struct_pde_C))} proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte va. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; isValidVTableRoot (cteCap cte); pd = capPDBasePtr (capCap (cteCap cte))\<rbrakk> \<Longrightarrow> capPDBasePtr (capCap (cteCap cte)) \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a)) \<and> (\<forall>pd. (page_directory_at' pd s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (the (capPDMappedASID (capCap (cteCap cte)))))) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (the (capPDMappedASID (capCap (cteCap cte))) && mask local.asid_low_bits) = Some pd))) \<longrightarrow> (pd \<noteq> capPDBasePtr (capCap (cteCap cte)) \<longrightarrow> capPDBasePtr (capCap (cteCap cte)) \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pd = capPDBasePtr (capCap (cteCap cte)) \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (the (capPDMappedASID (capCap (cteCap cte)))))) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (the (capPDMappedASID (capCap (cteCap cte))) && mask local.asid_low_bits) = Some (capPDBasePtr (capCap (cteCap cte))) \<and> page_directory_at' (capPDBasePtr (capCap (cteCap cte))) s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte va. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) (capPDBasePtr (capCap (cteCap cte))) = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; isValidVTableRoot (cteCap cte); pd = capPDBasePtr (capCap (cteCap cte)); {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cte))) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v)\<rbrakk> \<Longrightarrow> capPDBasePtr (capCap (cteCap cte)) \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a)) \<and> (\<forall>pd. (page_directory_at' pd s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (the (capPDMappedASID (capCap (cteCap cte)))))) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (the (capPDMappedASID (capCap (cteCap cte))) && mask local.asid_low_bits) = Some pd))) \<longrightarrow> (pd \<noteq> capPDBasePtr (capCap (cteCap cte)) \<longrightarrow> capPDBasePtr (capCap (cteCap cte)) \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pd = capPDBasePtr (capCap (cteCap cte)) \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (the (capPDMappedASID (capCap (cteCap cte)))))) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (the (capPDMappedASID (capCap (cteCap cte))) && mask local.asid_low_bits) = Some (capPDBasePtr (capCap (cteCap cte))) \<and> page_directory_at' (capPDBasePtr (capCap (cteCap cte))) s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y))\<rbrakk> \<Longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a)) \<and> (\<forall>pda. (page_directory_at' pda s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pda))) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pda = pd \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pd \<and> page_directory_at' pd s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y))\<rbrakk> \<Longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))
 2. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))\<rbrakk> \<Longrightarrow> (\<forall>pda. (page_directory_at' pda s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pda))) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pda = pd \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pd \<and> page_directory_at' pd s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); va \<in> set_option (pde_stored_asid v)\<rbrakk> \<Longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))
 2. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))\<rbrakk> \<Longrightarrow> (\<forall>pda. (page_directory_at' pda s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pda))) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pda = pd \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pd \<and> page_directory_at' pd s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = {va}; ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = {va}; cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); pde_stored_asid v = Some va\<rbrakk> \<Longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))
 2. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))\<rbrakk> \<Longrightarrow> (\<forall>pda. (page_directory_at' pda s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pda))) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pda = pd \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pd \<and> page_directory_at' pd s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))\<rbrakk> \<Longrightarrow> (\<forall>pda. (page_directory_at' pda s \<longrightarrow> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pda))) \<longrightarrow> (pda \<noteq> pd \<longrightarrow> pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a))) \<and> (pda = pd \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va}) \<and> (\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pd \<and> page_directory_at' pd s)))) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte va y. \<lbrakk>(s, s') \<in> rf_sr; pspace_aligned' s; pspace_distinct' s; valid_objs' s; no_0_obj' s; valid_pde_mappings' s; valid_arch_state' s; tcb_at' thread s; {va} = set_option (pde_stored_asid v); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState s)) pd = set_option (pde_stored_asid v); ctes_of s (thread + tcbVTableSlot * 0x10) = Some cte; {hwasid. (hwasid, pd) \<in> ran (armKSASIDMap (ksArchState s))} = set_option (pde_stored_asid v); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y)); pd \<in> ran (\<lambda>a. map_option snd (armKSASIDMap (ksArchState s) a)); capAligned (capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some y))); page_directory_at' pd s; 0 < y; y < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ((\<exists>ap. armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of y)) = Some ap \<and> (\<exists>pool. ko_at' (asidpool.ASIDPool pool) ap s \<and> pool (y && mask local.asid_low_bits) = Some pd)) \<longrightarrow> (\<exists>va. set_option (pde_stored_asid v) = {va})) \<and> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<and> ((\<exists>t. ret__unsigned_' t = stored_hw_asid_CL (pde_pde_invalid_lift v)) \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (thread + tcbVTableSlot * 0x10)) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> UCAST(32 \<rightarrow> 8) (stored_hw_asid_CL (pde_pde_invalid_lift v)) = the (pde_stored_asid v)) proof (prove)
goal:
No subgoals!