theory VSpace_C

lemma findPDForASID_ccorres:
  "ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) findPDForASID_xf
       (valid_arch_state' and no_0_obj' and (\<lambda>_. asid \<le> mask asid_bits))
       (UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace> )
       []
       (findPDForASID asid)
       (Call findPDForASID_'proc)" apply (rule ccorres_gen_asm) apply (cinit lift: asid_') apply (rule ccorres_Guard_Seq) apply (rule ccorres_Guard_Seq) apply (rule ccorres_assertE) apply (rule ccorres_assertE) apply (rule ccorres_liftE_Seq) apply (rule_tac  r'="\<lambda>asidTable rv'. rv' = option_to_ptr (asidTable (ucast (asid_high_bits_of asid)))"
               and xf'=poolPtr_' in ccorres_split_nothrow) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: simpler_gets_def Kernel_C.asidLowBits_def) apply (simp add: ucast_asid_high_bits_is_shift) apply (erule rf_sr_armKSASIDTable) apply (drule leq_asid_bits_shift) apply (simp add: asid_high_bits_def mask_def) apply ceqv apply (simp add: liftME_def) apply (simp add: bindE_assoc) apply (rename_tac asidTable poolPtr) apply (subgoal_tac "(doE x \<leftarrow> case asidTable (ucast (asid_high_bits_of asid)) of
                                     None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot
                                  |  Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
                              (case inv asidpool.ASIDPool x (asid && mask asid_low_bits) of
                                     None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot
                                   | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
                                                     withoutFailure $ checkPDAt ptr;
                                                     returnOk ptr
                                                 odE)
                           odE) =
                          (if ( asidTable (ucast (asid_high_bits_of asid))=None)
                             then (doE x\<leftarrow> throw Fault_H.lookup_failure.InvalidRoot;
                                       (case inv asidpool.ASIDPool x (asid && mask asid_low_bits) of
                                     None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot
                                   | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
                                                     withoutFailure $ checkPDAt ptr;
                                                     returnOk ptr
                                                 odE)
                                  odE)
                             else (doE x\<leftarrow> withoutFailure $ getObject (the (asidTable (ucast (asid_high_bits_of asid))));
                                      (case inv asidpool.ASIDPool x (asid && mask asid_low_bits) of
                                     None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot
                                   | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
                                                     withoutFailure $ checkPDAt ptr;
                                                     returnOk ptr
                                                 odE)
                                  odE))") prefer 2 apply (case_tac "asidTable (ucast (asid_high_bits_of asid))", clarsimp, clarsimp) apply simp apply (thin_tac "a = (if b then c else d)" for a b c d) apply (rule_tac Q="\<lambda>s. asidTable = (armKSASIDTable (ksArchState s))\<and> valid_arch_state' s \<and> no_0_obj' s \<and> (asid \<le> mask asid_bits) "
                 and Q'="\<lambda>s'. option_to_ptr (asidTable (ucast (asid_high_bits_of asid))) =
                              index (armKSASIDTable_' (globals s')) (unat (asid >> asid_low_bits))"
                 in ccorres_if_cond_throws) apply clarsimp apply (subgoal_tac "asid && mask asid_bits = asid") prefer 2 apply (rule less_mask_eq) apply (simp add: mask_def) apply (simp add: rf_sr_asidTable_None [symmetric] Collect_const_mem) apply (rule_tac P=\<top> and P' =UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def bindE_def bind_def Nondet_Monad.lift_def) apply (clarsimp simp: EXCEPTION_NONE_def EXCEPTION_LOOKUP_FAULT_def) apply (simp add: lookup_fault_lift_invalid_root) apply (simp add: Collect_const[symmetric] del: Collect_const) apply (rule ccorres_liftE_Seq) apply (rule ccorres_pre_getObject_asidpool) apply (rule ccorres_Guard_Seq)+ 

(*Note for Tom: apply wpc breaks here - blocks everything, cannot be interrupted *)
       apply (case_tac "inv ASIDPool rv (asid && mask asid_low_bits) = Some 0") apply simp apply (rule ccorres_fail') apply (rule_tac P="\<lambda>s. asidTable=armKSASIDTable (ksArchState s) \<and>
                              valid_arch_state' s \<and>  (asid \<le> mask asid_bits) "
                   and P'= "{s'. (\<exists>  ap'. cslift s' (ap_Ptr (the (asidTable (ucast (asid_high_bits_of asid)))))
                                             = Some ap' \<and> casid_pool_relation rv ap')}"
                   in ccorres_from_vcg_throws_nofail) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: ucast_asid_high_bits_is_shift) apply (frule_tac idx="(asid >> asid_low_bits)" in rf_asidTable, assumption,
                        simp add:  leq_asid_bits_shift) apply (clarsimp simp: option_to_ptr_def option_to_0_def) apply (clarsimp simp: typ_heap_simps) apply (case_tac rv, clarsimp simp: inv_def) apply (simp add:casid_pool_relation_def) apply (case_tac ap', simp) apply (simp add: array_relation_def) apply (erule_tac x="(asid && 2 ^ asid_low_bits - 1)" in allE) apply (simp add: word_and_le1 mask_def option_to_ptr_def option_to_0_def) apply (rename_tac "fun" array) apply (case_tac "fun (asid && 2 ^ asid_low_bits - 1)", clarsimp) apply (clarsimp simp: throwError_def  return_def ) apply (clarsimp simp: EXCEPTION_NONE_def EXCEPTION_LOOKUP_FAULT_def) apply (simp add: lookup_fault_lift_invalid_root) apply (clarsimp simp: returnOk_def return_def
        checkPDAt_def in_monad stateAssert_def liftE_bindE
        get_def bind_def assert_def fail_def
        split:if_splits) apply vcg apply simp apply wp apply vcg apply (clarsimp simp: Collect_const_mem) apply (simp add: Kernel_C.asidLowBits_def word_sle_def
                   asid_shiftr_low_bits_less order_le_less_trans[OF word_and_le1]
                   arg_cong[where f="\<lambda>x. 2 ^ x", OF meta_eq_to_obj_eq, OF asid_low_bits_def]) apply (clarsimp simp: option_to_0_def option_to_ptr_def) apply (clarsimp simp: typ_heap_simps split: option.split_asm) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (valid_arch_state' and no_0_obj' and (\<lambda>_. asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (findPDForASID asid) (Call findPDForASID_'proc) proof (prove)
goal (1 subgoal):
 1. asid \<le> mask local.asid_bits \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (valid_arch_state' and no_0_obj') (UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (findPDForASID asid) (Call findPDForASID_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q417 asida) (?Q'417 asida) [SKIP] (doE y <- assertE (0 < asid);
y <- assertE (asid \<le> snd asidRange);
asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
pool <- liftME (inv asidpool.ASIDPool) (case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)])));;
(IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))))
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 asida s \<and> s' \<in> ?Q'417 asida proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q417 asida) (?C'423 asida) [SKIP] (doE y <- assertE (0 < asid);
y <- assertE (asid \<le> snd asidRange);
asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
pool <- liftME (inv asidpool.ASIDPool) (case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]));;
(IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))))
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 asida s \<and> s' \<in> ?C'423 asida \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q417 asida) (?C'425 asida) [SKIP] (doE y <- assertE (0 < asid);
y <- assertE (asid \<le> snd asidRange);
asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
pool <- liftME (inv asidpool.ASIDPool) (case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]);;
(IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))))
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 asida s \<and> s' \<in> ?C'425 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q417 asida) (?C'425 asida) [SKIP] (doE y <- assertE (asid \<le> snd asidRange);
asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
pool <- liftME (inv asidpool.ASIDPool) (case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]);;
(IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))))
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 asida s \<and> s' \<in> ?C'425 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q417 asida) (?C'425 asida) [SKIP] (doE asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
pool <- liftME (inv asidpool.ASIDPool) (case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]);;
(IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))))
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 asida s \<and> s' \<in> ?C'425 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q417 asida) (?C'425 asida) [SKIP] (do asidTable <- gets (armKSASIDTable \<circ> ksArchState);
doE pool <- liftME (inv asidpool.ASIDPool) (case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE
od) (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]);;
(IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))))
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q417 asida s \<and> s' \<in> ?C'425 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ccorres (\<lambda>asidTable rv'. rv' = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) poolPtr_' (?P433 asida) (?P'433 asida) [SKIP] (gets (armKSASIDTable \<circ> ksArchState)) (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]))
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P433 asida and ?R433 asida) s \<and> s' \<in> ?P'433 asida \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<exists>(rv, \<sigma>')\<in>fst (gets (armKSASIDTable \<circ> ksArchState) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))}
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. Kernel_C.asidLowBits <s 0x20 \<and> (\<exists>(rv, \<sigma>')\<in>fst (gets (\<lambda>x. armKSASIDTable (ksArchState x)) \<sigma>). (\<sigma>', poolPtr_'_update (\<lambda>_. armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)]) s) \<in> rf_sr \<and> armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))}
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = option_to_ptr (armKSASIDTable (ksArchState \<sigma>) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = option_to_ptr (armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits))
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits \<le> 2 ^ local.asid_high_bits - 1
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x. \<lbrakk>0 < asid; asid \<le> snd asidRange; asid >> local.asid_low_bits \<le> mask local.asid_high_bits\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits \<le> 2 ^ local.asid_high_bits - 1
 2. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 3. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> ceqv \<Gamma> poolPtr_' rv' t t' (IF \<acute>poolPtr = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtr_' s} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(\<acute>poolPtr\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))) (?d'433 asida rv')
 2. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (?d'433 asida rv')
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asida rv) (?Q'433 asida rv rv') [SKIP] (doE pool <- liftME (inv asidpool.ASIDPool) (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr);
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (IF rv' = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(rv'\<rightarrow>[''array_C''])).[unat (asida && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid rv) (?Q'433 asid rv (option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE pool <- doE x <- case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
returnOk (inv asidpool.ASIDPool x)
odE;
case pool (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida rv rv'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; rv' = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid rv) (?Q'433 asid rv (option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid asidTable) (?Q'433 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE = (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid asidTable) (?Q'433 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE = (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE)
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE = (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE)
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE = (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid asidTable) (?Q'433 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE = (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid asidTable) (?Q'433 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); doE x <- case asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> withoutFailure $ getObject ptr;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE = (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE)\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid asidTable) (?Q'433 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?Q433 asid asidTable) (?Q'433 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (if asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None then doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE else doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Cond (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_') SKIP;;
(Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')))))
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>?Q433 asida\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> ?Q'433 asida rv (poolPtr_' s)}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> (asidTable = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asid \<le> mask local.asid_bits) \<and> option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] \<longrightarrow> (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None) = (s' \<in> (if option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 4. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 6. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 7. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None) = (s' \<in> (if armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL then UNIV else {}))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 4. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 6. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 7. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]; asid && mask local.asid_bits = asid\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None) = (s' \<in> (if armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL then UNIV else {}))
 2. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]\<rbrakk> \<Longrightarrow> asid && mask local.asid_bits = asid
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 4. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 5. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 6. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 7. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 8. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]\<rbrakk> \<Longrightarrow> asid && mask local.asid_bits = asid
 2. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]; asid && mask local.asid_bits = asid\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None) = (s' \<in> (if armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL then UNIV else {}))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 4. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 5. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 6. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 7. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 8. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]\<rbrakk> \<Longrightarrow> asid < 2 ^ local.asid_bits
 2. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]; asid && mask local.asid_bits = asid\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None) = (s' \<in> (if armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL then UNIV else {}))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 4. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 5. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 6. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 7. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 8. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; option_to_ptr (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)]; asid && mask local.asid_bits = asid\<rbrakk> \<Longrightarrow> (armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None) = (s' \<in> (if armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = NULL then UNIV else {}))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 4. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 6. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 7. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?R772 asid asidTable) (?R'768 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (\<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_')
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> ?R772 asida a s) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?R'768 asida rv (poolPtr_' s) \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst ((doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' s)}
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida asidTable poolPtr \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE x <- throw Fault_H.lookup_failure.InvalidRoot;
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) \<sigma>). (\<sigma>', globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s\<lparr>ret___struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), ret__struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) s\<lparr>ret___struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), ret__struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), global_exn_var_' := Return\<rparr>)))}
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asidTable \<sigma> x t. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None; (\<sigma>, x) \<in> rf_sr; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> EXCEPTION_LOOKUP_FAULT \<noteq> EXCEPTION_NONE \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asidTable \<sigma> x t. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = None; (\<sigma>, x) \<in> rf_sr; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- withoutFailure $ getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds (if asid && 2 ^ local.asid_low_bits - 1 < 0x400 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (doE x <- liftE (getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))));
case inv asidpool.ASIDPool x (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
odE) (Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?U770 asid asidTable) (?U'764 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) [SKIP] (do a <- getObject (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))));
case inv asidpool.ASIDPool a (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE
od) (Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> ?U770 asida a s)\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> ?U'764 asida rv (poolPtr_' s))}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (\<lambda>a. ?P844 asid asidTable a rv) (?P'846 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (Guard ArrayBounds \<lbrace>asid && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]))));;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> ?P844 asida a s asidpool))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?P'846 asida rv (poolPtr_' s) asidpool})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> ?P853 asida a asidpool s))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'867 asida rv (poolPtr_' s) asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> ?P853 asida a asidpool s))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'867 asida rv (poolPtr_' s) asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) = Some 0\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> ?P853 asida a asidpool s))\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'867 asida rv (poolPtr_' s) asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) = Some 0\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] fail (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> ?P853 asida a asidpool s))\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'867 asida rv (poolPtr_' s) asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_') (?P853 asid asidTable rv) (?C'867 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) rv) [SKIP] (case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) (\<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> ?P853 asida a asidpool s))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> ?C'867 asida rv (poolPtr_' s) asidpool \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr rv. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (asidTable = armKSASIDTable (ksArchState \<sigma>) \<and> valid_arch_state' \<sigma> \<and> asid \<le> mask local.asid_bits) \<and> s \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) = Some ap' \<and> casid_pool_relation rv ap'} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>pd :== h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)];;
(IF \<acute>pd = NULL THEN
  \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'
FI;;
(\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. \<acute>pd) \<acute>ret___struct_findPDForASID_ret_C;;
(\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_'))) {},{s. \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' s))}
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>asida asidTable poolPtr rv \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))); \<exists>y. asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0\<rbrakk> \<Longrightarrow> {s. (asidTable = armKSASIDTable (ksArchState \<sigma>) \<and> valid_arch_state' \<sigma> \<and> asid \<le> mask local.asid_bits) \<and> s \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) = Some ap' \<and> casid_pool_relation rv ap'} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). (\<sigma>', globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) s)\<lparr>ret___struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), ret__struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) s)\<lparr>ret___struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), ret__struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (pd_C_update (\<lambda>_. NULL) (ret___struct_findPDForASID_ret_C_' s)), global_exn_var_' := Return\<rparr>))))) \<and> (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). (\<sigma>', s\<lparr>pd_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (ret___struct_findPDForASID_ret_C_' s)), ret__struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (ret___struct_findPDForASID_ret_C_' s)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (s\<lparr>pd_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (ret___struct_findPDForASID_ret_C_' s)), ret__struct_findPDForASID_ret_C_' := findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (PTR(pde_C ptr[1024]) &(option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (ret___struct_findPDForASID_ret_C_' s)), global_exn_var_' := Return\<rparr>))))}
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv \<sigma> x y ap'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some ap'; casid_pool_relation rv ap'\<rbrakk> \<Longrightarrow> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv \<sigma> x y ap'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some ap'; casid_pool_relation rv ap'; case armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) of None \<Rightarrow> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = NULL | Some v \<Rightarrow> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr v \<and> armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] \<noteq> NULL\<rbrakk> \<Longrightarrow> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(option_to_ptr (Some y)\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv \<sigma> x y ap'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some ap'; casid_pool_relation rv ap'; armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0\<rbrakk> \<Longrightarrow> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr y\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr y\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr y\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr y\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals x))) (PTR(pde_C ptr[1024]) &(ap_Ptr y\<rightarrow>[''array_C''])).[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>rv \<sigma> x y ap'. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some ap'; casid_pool_relation rv ap'; armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0\<rbrakk> \<Longrightarrow> (array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case inv asidpool.ASIDPool rv (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' xa. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; xa (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some ap'; casid_pool_relation (asidpool.ASIDPool xa) ap'; armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0\<rbrakk> \<Longrightarrow> (array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' xa. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; xa (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some ap'; case ap' of asid_pool_C.asid_pool_C x \<Rightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) xa x; armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0\<rbrakk> \<Longrightarrow> (array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array_C ap'.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' xa xb. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; xa (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C xb); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) xa xb; armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := xb.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' xa xb. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; xa (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C xb); \<forall>i\<le>2 ^ local.asid_low_bits - 1. option_to_ptr (xa i) = xb.[unat i]; armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C xb\<rbrakk> \<Longrightarrow> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := xb.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' xa xb. \<lbrakk>asid \<le> mask local.asid_bits; 0 < asid; asid \<le> snd asidRange; xa (asid && mask local.asid_low_bits) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C xb); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C xb; asid && 2 ^ local.asid_low_bits - 1 \<le> 2 ^ local.asid_low_bits - 1 \<longrightarrow> option_to_ptr (xa (asid && 2 ^ local.asid_low_bits - 1)) = xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]\<rbrakk> \<Longrightarrow> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && mask local.asid_low_bits) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := xb.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' xa xb. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; xa (asid && 2 ^ local.asid_low_bits - 1) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C xb); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C xb; pde_Ptr (case xa (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) = xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]\<rbrakk> \<Longrightarrow> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case xa (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (xb.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case xa (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case xa (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := xb.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. xb.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' fun array. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; fun (asid && 2 ^ local.asid_low_bits - 1) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C array; pde_Ptr (case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]\<rbrakk> \<Longrightarrow> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x y fun array t. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; NULL = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = None; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))
 2. \<And>\<sigma> x y ap' fun array a. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; fun (asid && 2 ^ local.asid_low_bits - 1) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C array; pde_Ptr (case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = Some a\<rbrakk> \<Longrightarrow> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x y fun array t. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; NULL = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = None; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> EXCEPTION_LOOKUP_FAULT \<noteq> EXCEPTION_NONE \<and> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root
 2. \<And>\<sigma> x y ap' fun array a. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; fun (asid && 2 ^ local.asid_low_bits - 1) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C array; pde_Ptr (case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = Some a\<rbrakk> \<Longrightarrow> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x y fun array t. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; NULL = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = None; lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root\<rbrakk> \<Longrightarrow> lookup_fault_lift (ret__struct_lookup_fault_C_' t) = Some Lookup_fault_invalid_root
 2. \<And>\<sigma> x y ap' fun array a. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; fun (asid && 2 ^ local.asid_low_bits - 1) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C array; pde_Ptr (case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = Some a\<rbrakk> \<Longrightarrow> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 3. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 5. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 6. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y ap' fun array a. \<lbrakk>asid < 2 ^ local.asid_bits; 0 < asid; asid \<le> snd asidRange; fun (asid && 2 ^ local.asid_low_bits - 1) \<noteq> Some 0; armKSASIDTable (ksArchState \<sigma>) (asid >> local.asid_low_bits) = Some y; valid_arch_state' \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ap_Ptr y) = Some (asid_pool_C.asid_pool_C array); armKSASIDTable_' (globals x).[unat (asid >> local.asid_low_bits)] = ap_Ptr y; y \<noteq> 0; ap' = asid_pool_C.asid_pool_C array; pde_Ptr (case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) = array.[unat (asid && 2 ^ local.asid_low_bits - 1)]; fun (asid && 2 ^ local.asid_low_bits - 1) = Some a\<rbrakk> \<Longrightarrow> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] = NULL \<longrightarrow> (\<forall>t. lookup_fault_get_tag (ret__struct_lookup_fault_C_' t) = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (globals_update (current_lookup_fault_'_update (\<lambda>_. ret__struct_lookup_fault_C_' t)) (pd_'_update (\<lambda>_. NULL) x)\<lparr>ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. NULL) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))) \<and> (array.[unat (asid && 2 ^ local.asid_low_bits - 1)] \<noteq> NULL \<longrightarrow> \<not> snd ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>) \<longrightarrow> (\<exists>xa\<in>fst ((case fun (asid && 2 ^ local.asid_low_bits - 1) of None \<Rightarrow> throw Fault_H.lookup_failure.InvalidRoot | Some ptr \<Rightarrow> doE haskell_assertE (ptr \<noteq> 0) [];
withoutFailure $ checkPDAt ptr;
returnOk ptr
odE) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (lookup_failure_rel \<currency> (\<lambda>pdeptrc pdeptr. pdeptr = pde_Ptr pdeptrc)) rv (liftxf errstate findPDForASID_ret_C.status_C pd_C ret__struct_findPDForASID_ret_C_' (x\<lparr>pd_' := array.[unat (asid && 2 ^ local.asid_low_bits - 1)], ret___struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), ret__struct_findPDForASID_ret_C_' := pd_C_update (\<lambda>_. array.[unat (asid && 2 ^ local.asid_low_bits - 1)]) (findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_findPDForASID_ret_C_' x)), global_exn_var_' := Return\<rparr>))))
 2. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 4. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 5. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>asida asidTable poolPtr. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange; poolPtr = option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'766 asid asidTable (option_to_ptr (asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) \<acute>current_lookup_fault :== CALL lookup_fault_invalid_root_new_'proc();;
\<acute>ret___struct_findPDForASID_ret_C :== pd_C_update (\<lambda>_. NULL) \<acute>ret___struct_findPDForASID_ret_C;;
\<acute>ret___struct_findPDForASID_ret_C :== findPDForASID_ret_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_LOOKUP_FAULT) \<acute>ret___struct_findPDForASID_ret_C;;
return_C ret__struct_findPDForASID_ret_C_'_update ret___struct_findPDForASID_ret_C_' {},UNIV
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 3. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> ?PT'766 asida rv (poolPtr_' s)) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 4. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asida\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a. (\<lambda>s. a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> no_0_obj' s \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = None \<longrightarrow> True) and (\<lambda>s. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) \<noteq> None \<longrightarrow> (\<forall>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) s \<longrightarrow> a = armKSASIDTable (ksArchState s) \<and> valid_arch_state' s \<and> asida \<le> mask local.asid_bits))\<rbrace>
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 3. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<lbrace>?R433 asid\<rbrace> gets (armKSASIDTable \<circ> ksArchState) \<lbrace>\<lambda>a b. a = armKSASIDTable (ksArchState b) \<and> valid_arch_state' b \<and> no_0_obj' b \<and> ((\<exists>y. a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) = Some y) \<longrightarrow> (\<exists>asidpool. ko_at' asidpool (the (a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) b) \<longrightarrow> a = armKSASIDTable (ksArchState b) \<and> valid_arch_state' b)\<rbrace>
 2. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 3. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R433 asida) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>asida. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; 0 < asid; asid \<le> snd asidRange\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F433 asida\<^esub> (?R'433 asida) Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>poolPtr :== \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]) {s. \<forall>rv. poolPtr_' s = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> s \<in> \<lbrace>\<^bsup>s\<^esup>poolPtr = \<acute>armKSASIDTable.[unat (asida >> local.asid_low_bits)]\<rbrace> \<inter> {sa. (sa \<in> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> (if poolPtr_' s = NULL then UNIV else {}) \<longrightarrow> sa \<in> {sa. \<forall>asidpool asidpool'. cslift sa (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> sa \<in> {s'. \<exists>ap'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some ap' \<and> casid_pool_relation asidpool ap'} \<inter> \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> {sa. sa \<Turnstile>\<^sub>c poolPtr_' s} \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>})}}
 2. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. (armKSASIDTable \<circ> ksArchState) a = armKSASIDTable (ksArchState a) \<and> valid_arch_state' a \<and> no_0_obj' a \<and> ((\<exists>y. (armKSASIDTable \<circ> ksArchState) a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = Some y) \<longrightarrow> (\<exists>asidpool. ko_at' asidpool (the ((armKSASIDTable \<circ> ksArchState) a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) a) \<longrightarrow> (armKSASIDTable \<circ> ksArchState) a = armKSASIDTable (ksArchState a) \<and> valid_arch_state' a))) s \<and> s' \<in> UNIV \<inter> ?R'433 asida \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>asida s s'. \<lbrakk>asid \<le> mask local.asid_bits; asida = asid; (s, s') \<in> rf_sr; (valid_arch_state' and no_0_obj') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. (armKSASIDTable \<circ> ksArchState) a = armKSASIDTable (ksArchState a) \<and> valid_arch_state' a \<and> no_0_obj' a \<and> ((\<exists>y. (armKSASIDTable \<circ> ksArchState) a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)) = Some y) \<longrightarrow> (\<exists>asidpool. ko_at' asidpool (the ((armKSASIDTable \<circ> ksArchState) a (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida)))) a) \<longrightarrow> (armKSASIDTable \<circ> ksArchState) a = armKSASIDTable (ksArchState a) \<and> valid_arch_state' a))) s \<and> s' \<in> UNIV \<inter> {s. Kernel_C.asidLowBits <s 0x20 \<longrightarrow> (\<forall>rv. armKSASIDTable_' (globals s).[unat (asida >> local.asid_low_bits)] = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> poolPtr_'_update (\<lambda>_. option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)))) s \<notin> (if option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) = NULL then UNIV else {}) \<longrightarrow> (\<forall>asidpool asidpool'. cslift s (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asida))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool' \<longrightarrow> (\<exists>ap'. Some asidpool' = Some ap' \<and> casid_pool_relation asidpool ap') \<and> 0 \<le>s Kernel_C.asidLowBits \<and> s \<Turnstile>\<^sub>c option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))} \<inter> \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> \<inter> \<lbrace>asida >> local.asid_low_bits < 0x80\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s\<rbrakk> \<Longrightarrow> (Kernel_C.asidLowBits <s 0x20 \<longrightarrow> (\<forall>rv. armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<noteq> NULL \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> 0 \<le>s Kernel_C.asidLowBits \<and> s' \<Turnstile>\<^sub>c option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<and> asid && 2 ^ local.asid_low_bits - 1 < 0x400)) \<and> 0 \<le>s Kernel_C.asidLowBits \<and> asid >> local.asid_low_bits < 0x80 proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>asid \<le> mask local.asid_bits; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s\<rbrakk> \<Longrightarrow> \<forall>rv. armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<longrightarrow> option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) \<noteq> NULL \<longrightarrow> (\<exists>asidpool asidpool'. cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) = Some asidpool' \<and> casid_pool_relation asidpool asidpool') \<longrightarrow> s' \<Turnstile>\<^sub>c option_to_ptr (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv asidpool asidpool'. \<lbrakk>asid \<le> mask local.asid_bits; (s, s') \<in> rf_sr; valid_arch_state' s; no_0_obj' s; armKSASIDTable_' (globals s').[unat (asid >> local.asid_low_bits)] = ap_Ptr (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> 0 | Some y \<Rightarrow> y); (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) \<noteq> 0; cslift s' (ap_Ptr (the (rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid))))) = Some asidpool'; casid_pool_relation asidpool asidpool'\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c ap_Ptr (case rv (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) of None \<Rightarrow> 0 | Some y \<Rightarrow> y) proof (prove)
goal:
No subgoals!